AWS EC2 Network ACL Deletion Defense Evasion

Adversaries targeting AWS environments may attempt to impair security defenses by modifying or deleting Network Access Control Lists (ACLs) within a Virtual Private Cloud (VPC). By removing these firewall layers, attackers can bypass traffic filtering, enable lateral movement, or facilitate the exfiltration of sensitive data. This activity typically manifests as API calls within AWS CloudTrail, specifically targeting the DeleteNetworkAcl or DeleteNetworkAclEntry actions. Because Network ACLs are critical for subnet security, unauthorized deletions are significant indicators of potential defense evasion. Organizations must distinguish these malicious modifications from legitimate infrastructure-as-code (IaC) updates, such as those performed by Terraform, Pulumi, or Ansible, which may legitimately manage network configurations in automated environments.

Impact

Successful deletion of Network ACLs exposes subnets to unauthorized inbound and outbound traffic, effectively nullifying intended network security perimeters. This can result in unauthorized access to sensitive internal resources, facilitate command-and-control communication, or enable the unauthorized exfiltration of data from the affected VPC subnets.

Recommendation

• Deploy the Sigma-compatible rule below to monitor for unauthorized Network ACL deletions in AWS CloudTrail logs.
• Establish a baseline of authorized administrative and IaC service accounts to tune out legitimate network configuration changes.
• Implement AWS CloudTrail alerts for DeleteNetworkAcl and DeleteNetworkAclEntry events, prioritizing alerts that lack association with recognized automated deployment roles.
• Review IAM policies to ensure that only essential roles possess permissions for ec2:DeleteNetworkAcl and ec2:DeleteNetworkAclEntry actions.
• Enable VPC Flow Logs to monitor traffic patterns following any detected modifications to network security configurations.