some legitimate architectures use permissive nacls as a passthrough layer while relying on security groups for access control. validate that the modified nacl is associated with subnets where this design pattern is expected and that the change was authorized through a change management process.

Techniques

T1562

Sample rules

AWS EC2 NACL Entry Created or Replaced Allowing All Traffic by New Identity

source: elastic
technicques:
- T1562

Description

Detects a principal account creating or replacing - or attempts to create or replace - an AWS Network Access Control List (NACL) entry using protocol -1 (all traffic). Both successful and failed outcomes are included. A NACL entry with protocol -1 passes all traffic regardless of port, which would disable network-layer controls for the affected subnets. Monitoring for new identities performing this change helps surface freshly compromised credentials or unauthorized principals removing a defense-in-depth layer to facilitate lateral movement or data exfiltration. This signal only flags if this behavior was not observed historically in a specific time window.

Detection logic

data_stream.dataset: "aws.cloudtrail"
    and event.provider: "ec2.amazonaws.com"
    and event.action: ("CreateNetworkAclEntry" or "ReplaceNetworkAclEntry")
    and not aws.cloudtrail.user_identity.type: "AWSService"
    and event.outcome: ("success" or "failure")
    and aws.cloudtrail.flattened.request_parameters.aclProtocol: "-1"
    and aws.cloudtrail.flattened.request_parameters.ruleAction: "allow"
    and not user_agent.original: (*Terraform* or *terraform* or "cloudformation.amazonaws.com" or *pulumi* or *Pulumi*)