AWS Network Access Control List - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/aws-network-access-control-list/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioWed, 03 Jan 2024 12:00:00 +0000AWS Network Access Control List Deletion Detectedhttps://feed.craftedsignal.io/briefs/2024-01-03-aws-network-acl-deleted/Wed, 03 Jan 2024 12:00:00 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2024-01-03-aws-network-acl-deleted/Detection of AWS Network Access Control List (ACL) deletion events via CloudTrail logs indicates a potential attempt to weaken network security controls.This brief focuses on the detection of AWS Network Access Control List (ACL) deletions using AWS CloudTrail logs. The deletion of a network ACL entry, specifically the DeleteNetworkAclEntry event, is a critical event that could indicate a malicious actor attempting to bypass existing network security controls. These ACLs are designed to restrict network access, so their removal can expose cloud instances to unauthorized access, data exfiltration, and further compromise. The source Splunk analytic leverages AWS CloudTrail data to detect instances where a user deletes a network ACL entry. Early detection of this activity is crucial for maintaining the integrity and security of AWS environments. The detection logic requires the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later).

Attack Chain

  1. An attacker gains initial access to an AWS account, potentially through compromised credentials or exploiting a vulnerability. (T1566)
  2. The attacker enumerates existing Network ACLs to identify potential targets for deletion. (T1082)
  3. The attacker executes the DeleteNetworkAclEntry command, removing specific rules from the targeted ACLs. (T1562.007)
  4. CloudTrail logs the DeleteNetworkAclEntry event, capturing details such as the user, timestamp, and affected ACL.
  5. The monitoring system detects the deletion event based on the CloudTrail logs.
  6. The deletion of the ACL entry weakens the network security posture, potentially opening unauthorized access to resources.
  7. The attacker exploits the newly opened network paths to access previously protected resources.
  8. The attacker achieves their objective, such as data exfiltration, lateral movement, or resource compromise.

Impact

The successful deletion of network ACL entries can have severe consequences, including unauthorized access to sensitive data, compromise of critical systems, and potential data exfiltration. This can lead to financial losses, reputational damage, and regulatory penalties. If an attacker successfully removes key ACLs, they can bypass network segmentation and gain access to previously isolated environments, potentially impacting hundreds or thousands of instances, depending on the scale of the AWS deployment.

Recommendation

  • Deploy the provided Sigma rule to your SIEM to detect AWS Network ACL deletions using CloudTrail logs.
  • Investigate any detected DeleteNetworkAclEntry events in CloudTrail to determine the legitimacy of the activity and the user involved.
  • Enable and review CloudTrail logs regularly to ensure comprehensive monitoring of AWS environment changes.
  • Enforce multi-factor authentication (MFA) for all AWS accounts to mitigate the risk of compromised credentials.
  • Implement principle of least privilege to limit the number of IAM roles that are able to modify Network ACLs.
]]>highadvisoryawscloudtrailnetwork-acldefense-evasionAWS Network Access Control List Created with All Open Portshttps://feed.craftedsignal.io/briefs/2024-01-aws-open-nacls/Wed, 03 Jan 2024 12:00:00 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2024-01-aws-open-nacls/An AWS Network Access Control List (NACL) configured to allow all ports and protocols, potentially exposing resources to unauthorized access.This alert identifies a potentially misconfigured AWS Network Access Control List (NACL). NACLs act as a firewall for controlling traffic in and out of one or more subnets. When a NACL is configured to allow all ports and protocols (0.0.0.0/0 for all traffic), it effectively bypasses network-level security controls. While there may be legitimate reasons for such a configuration, it often indicates a security oversight, such as a default configuration not properly secured or an intentional circumvention of security policies. The creation of overly permissive NACLs can lead to significant risk by allowing unrestricted network access to critical resources, potentially leading to data breaches, unauthorized access, or other malicious activities. This detection focuses on the misconfiguration itself, regardless of the actor or intent behind it.

Attack Chain

  1. An attacker identifies a target AWS environment.
  2. The attacker identifies or creates a new AWS Network ACL with ingress and egress rules allowing all traffic (0.0.0.0/0).
  3. The attacker associates this overly permissive NACL with one or more subnets within the target AWS Virtual Private Cloud (VPC).
  4. The attacker leverages the open NACL to scan for vulnerable services and systems within the associated subnets.
  5. The attacker exploits identified vulnerabilities to gain initial access to a system within the subnet.
  6. The attacker moves laterally to other systems within the open network segment.
  7. The attacker escalates privileges to gain administrative control of the environment.
  8. The attacker exfiltrates sensitive data or deploys malicious payloads such as ransomware.

Impact

The creation of a Network Access Control List with all open ports significantly expands the attack surface of the affected AWS environment. Successful exploitation could lead to unauthorized access to sensitive data, system compromise, data breaches, and potential financial loss. The scope of impact depends on the resources exposed by the open NACL and the attacker's ability to move laterally within the environment.

Recommendation

  • Implement the Sigma rule AWS NACL Created with All Open Ports to detect the creation of overly permissive NACLs and trigger investigation.
  • Regularly review and audit existing NACL configurations to identify and remediate overly permissive rules.
  • Implement the principle of least privilege when configuring NACLs, allowing only necessary traffic.
  • Enable AWS CloudTrail logging and monitor for NACL creation events to ensure proper oversight and detection.
  • Implement alerting for changes to NACL configurations in your SIEM/SOAR platform based on the aws_network_access_control_list_created_with_all_open_ports.yml detection logic.
]]>highadvisorycloudawsnetwork-aclmisconfiguration