Skip to content
Threat Feed
Subscribe
medium advisory

Monitoring Unauthorized AWS Security Group Modifications

Adversaries modify AWS VPC security group ingress rules to permit unrestricted external access to sensitive management ports, facilitating remote access or future exploitation of cloud instances.

Security teams must monitor for unauthorized modifications to AWS VPC security group ingress rules that permit traffic from all IP addresses (0.0.0.0/0 or ::/0) to sensitive remote management ports. Adversaries leverage this technique to establish persistent access or provide a conduit for further exploitation of EC2 instances. By modifying cloud firewalls, attackers can bypass perimeter restrictions and expose instances to the public internet, increasing the attack surface significantly. While legitimate administrative workflows - such as automated CI/CD deployments or maintenance windows - may perform similar actions, malicious modification is often characterized by the absence of expected service account signatures (e.g., Terraform or Pulumi user agents) or unexpected geographic origins. Monitoring for these specific CloudTrail events is essential for detecting the abuse of cloud management privileges.

Impact

Successful exploitation allows attackers to bypass network-level security controls, providing direct remote access to EC2 instances via protocols like SSH (22) or RDP (3389). This exposure can lead to unauthorized data exfiltration, lateral movement within the cloud environment, or the deployment of additional malicious payloads. Improperly configured security groups remain a leading cause of accidental and intentional cloud resource compromise.

Recommendation

  • Deploy the provided Sigma rule to identify unauthorized ingress modifications in AWS CloudTrail logs.
  • Audit all existing VPC security groups to ensure they adhere to the principle of least privilege, explicitly removing rules that allow unrestricted access (0.0.0.0/0) to sensitive ports.
  • Implement service-control policies (SCPs) or IAM policies that restrict the ability to modify security group ingress rules to only authorized, audited service accounts.
  • Review CloudTrail logs for events matching 'AuthorizeSecurityGroupIngress' where the requestor does not match known automation tool user agents.

Immediate actions

Review recent AuthorizeSecurityGroupIngress events for unauthorized cidrIp values.

SOC 24h

Mitigations

Audit all security groups for public ingress on ports 22, 3389, and similar management services.

immediate IT Operations

T1562.007

Detection coverage 1

Detect Insecure AWS EC2 Security Group Ingress Modification

medium

Detects unauthorized addition of ingress rules allowing unrestricted access (0.0.0.0/0) to remote access ports (SSH, RDP, etc.) in AWS EC2.

sigma tactics: defense_evasion, initial_access techniques: T1133, T1562.007 sources: cloud, aws

Detection queries are available on the platform. Get full rules →