Attack Chain

1. The attacker gains unauthorized access to an AWS account with sufficient IAM permissions to manage WAF resources, potentially through compromised credentials or privilege escalation.
2. The attacker authenticates to the AWS environment using the compromised credentials or assumed role.
3. The attacker uses the AWS CLI, SDK, or Management Console to issue a DeleteWebACL API call targeting a specific Web ACL.
4. The API call is successful, and the targeted Web ACL is removed from the AWS environment.
5. All rules, protections, and logging configurations associated with the deleted Web ACL are immediately disabled.
6. Web applications previously protected by the deleted Web ACL are now exposed to potentially malicious traffic without filtering or monitoring.
7. The attacker may then exploit vulnerabilities in the exposed web applications to gain unauthorized access or steal sensitive data.

Impact

The deletion of a Web ACL can have significant consequences. Applications previously protected by the Web ACL are exposed to direct exploitation. This could lead to web application compromise, data theft, or resource abuse. The number of affected applications depends on the scope of the deleted Web ACL. Successful exploitation can result in financial loss, reputational damage, and legal liabilities.

Recommendation

• Enable AWS CloudTrail logging for all regions to capture API activity related to WAF configurations and deletions. Use data_stream.dataset: aws.cloudtrail and event.provider: (waf.amazonaws.com or waf-regional.amazonaws.com or wafv2.amazonaws.com) to filter logs (see query in this brief).
• Deploy the Sigma rule to detect unauthorized Web ACL deletions and tune it to your environment, accounting for authorized deletions during maintenance windows or IaC deployments.
• Restrict IAM permissions for waf:DeleteWebACL and wafv2:DeleteWebACL to a limited set of trusted roles, enforcing MFA for administrative access to prevent unauthorized deletions.
• Monitor aws.cloudtrail.user_identity.arn and access_key_id in CloudTrail logs to identify the actor initiating the deletion and determine if the principal normally manages WAF resources (see investigation fields).