Waf

Adversaries with high-level privileges may delete AWS Web Application Firewall (WAF) Web ACLs to disable security controls and facilitate unauthorized access to protected applications.

Multiple vulnerabilities have been identified in Progress Software LoadMaster and MOVEit WAF products, allowing an attacker from an adjacent network to execute arbitrary program code and gain root privileges on the affected systems.

Detection of Azure Front Door Web Application Firewall (WAF) policy deletion, which can indicate an attacker's attempt to evade defenses by removing a security layer protecting web applications.

Detection of AWS WAF rule or rule group deletions, which can weaken web application security and expose applications to various attacks.

Detection of AWS Web Application Firewall (WAF) Web ACL deletion, which adversaries may perform to disable security controls, evade detection, and prepare for subsequent attacks, potentially leading to web-application compromise, data theft, or resource abuse.