Tag
AWS Network ACL Created with All Ports Open
2 rules 1 TTPAn AWS Network Access Control List (ACL) is created with all ports open, potentially exposing resources to unrestricted network access.
AWS Network ACL Deletion Detection
2 rules 1 TTPDetection of AWS Network Access Control List (ACL) deletion via CloudTrail logs, potentially indicating malicious attempts to bypass network security controls and gain unauthorized access.
AWS Network ACL Deletion Detected
2 rulesDetection of AWS Network Access Control List (ACL) deletion via CloudTrail logs indicating potential unauthorized access or data exfiltration.
AWS Network Access Control List Deletion Detected
3 rules 1 TTPDetection of AWS Network Access Control List (ACL) deletion events via CloudTrail logs indicates a potential attempt to weaken network security controls.
AWS Network Access Control List Created with All Open Ports
2 rules 1 TTPAn AWS Network Access Control List (NACL) configured to allow all ports and protocols, potentially exposing resources to unauthorized access.
AWS Network ACL Created with All Ports Open
2 rulesThe analytic detects the creation or replacement of AWS Network Access Control Lists (ACLs) with rules that allow all traffic from a specified CIDR block, potentially exposing the network to unauthorized access and increasing the risk of data breaches.
AWS Network Access Control List Created with All Open Ports
2 rulesThe analytic detects the creation of AWS Network Access Control Lists (ACLs) with all ports open to a specified CIDR by monitoring `CreateNetworkAclEntry` or `ReplaceNetworkAclEntry` actions with rules allowing all traffic, potentially leading to unauthorized network access.
AWS EC2 Network Access Control List Creation
2 rules 3 TTPsThe rule detects the creation of an AWS EC2 network access control list (ACL) or an entry in a network ACL with a specified rule number, which adversaries may exploit to establish persistence or defense evasion by creating permissive rules.