Waf - CraftedSignal Threat Feed

Azure Front Door WAF Policy Deletion Detection

hello@craftedsignal.io — Tue, 09 Jan 2024 14:30:00 +0000

This threat brief focuses on the detection of unauthorized or malicious deletion of Azure Front Door Web Application Firewall (WAF) policies. Azure Front Door WAF policies are critical security controls that protect web applications by filtering and monitoring HTTP requests, blocking malicious traffic and preventing exploitation of vulnerabilities. An adversary may delete these policies to bypass security measures, facilitating unauthorized access, data exfiltration, or other malicious activities. The deletion of a WAF policy can have a significant impact, potentially exposing web applications to a wide range of attacks, including SQL injection, cross-site scripting (XSS), and other web-based threats. Defenders should monitor for unexpected deletions of these policies and promptly investigate any such events. This brief provides guidance for detection engineers to identify and respond to this type of defense evasion.

Attack Chain

Initial Access: The attacker gains access to an Azure account with sufficient privileges to manage Front Door WAF policies, possibly through compromised credentials or exploiting a privilege escalation vulnerability.
Discovery: The attacker enumerates existing Front Door WAF policies to identify targets for disabling or deletion.
Defense Evasion: The attacker initiates the deletion of a Front Door WAF policy using the Azure portal, Azure CLI, or PowerShell. The specific operation name is "MICROSOFT.NETWORK/FRONTDOORWEBAPPLICATIONFIREWALLPOLICIES/DELETE".
Persistence (Optional): The attacker may attempt to prevent detection by disabling logging or other security monitoring features within Azure.
Impact: With the WAF policy removed, web applications protected by the policy become vulnerable to a wide range of web-based attacks.
Further Exploitation: The attacker leverages the unprotected web applications to gain unauthorized access to sensitive data, deploy malware, or perform other malicious activities.

Impact

Successful deletion of a Front Door WAF policy can expose web applications to a variety of attacks, including SQL injection, cross-site scripting (XSS), and DDoS attacks. This can lead to data breaches, service disruptions, and reputational damage. The severity of the impact depends on the criticality of the protected applications and the sensitivity of the data they process.

Recommendation

Deploy the Sigma rule Azure Front Door WAF Policy Deleted to your SIEM to detect unauthorized WAF policy deletions by monitoring Azure activity logs.
Enable Azure Activity Log monitoring and ensure logs are ingested into your SIEM to provide the data source for the detection rule.
Implement Role-Based Access Control (RBAC) with the principle of least privilege to restrict access to Azure management operations and minimize the risk of unauthorized policy modifications.
Investigate any identified WAF policy deletion events by examining the associated user identity and the context of the deletion, as described in the overview.

AWS WAF Rule or Rule Group Deletion

hello@craftedsignal.io — Tue, 09 Jan 2024 12:00:00 +0000

This threat brief focuses on the deletion of AWS Web Application Firewall (WAF) rules or rule groups. AWS WAF rules and rule groups are essential for protecting web applications by filtering malicious HTTP requests, blocking known attack patterns, and enforcing access controls. The deletion of these rules, even temporarily, can expose applications to significant risks, including SQL injection, cross-site scripting, and credential stuffing. Threat actors with sufficient permissions may remove WAF protections as part of a defense evasion or impact strategy, with the goal of data theft or application compromise. The focus is on detecting successful DeleteRule or DeleteRuleGroup API calls within CloudTrail logs.

Attack Chain

Initial Access: The attacker gains access to an AWS account with sufficient permissions to modify WAF configurations. This could be achieved through compromised credentials or an IAM role with excessive privileges.
Privilege Escalation (Optional): If the initial access lacks the necessary permissions, the attacker may attempt to escalate privileges within the AWS environment, potentially exploiting misconfigured IAM policies.
Discovery: The attacker enumerates existing WAF rules and rule groups within the targeted AWS account, identifying the rules that provide key protections for web applications.
Defense Evasion: The attacker deletes a WAF rule or rule group using the DeleteRule or DeleteRuleGroup API call, effectively disabling the protections it provided.
Exploitation: With the WAF rule removed, the attacker exploits vulnerabilities in the web application that were previously protected by the rule. This could involve SQL injection, cross-site scripting, or other attack vectors.
Data Exfiltration (Optional): If the exploitation is successful, the attacker may exfiltrate sensitive data from the compromised web application or its backend systems.
Impact: The attacker achieves their objective, which could include data theft, application compromise, or denial of service.

Impact

Successful deletion of WAF rules can have significant consequences, potentially affecting numerous web applications and their users. The number of affected applications and users depends on the scope of the deleted rules and the criticality of the protected applications. If an attack succeeds, organizations may experience data breaches, financial losses, reputational damage, and regulatory fines.

Recommendation

Enable AWS CloudTrail logging and monitor for DeleteRule and DeleteRuleGroup API calls to detect WAF rule deletions (reference: query in the source).
Implement the Sigma rule AWS WAF Rule Deletion to identify suspicious WAF rule deletion activity (reference: Sigma rule below).
Implement the Sigma rule AWS WAF Rule Group Deletion to identify suspicious WAF rule group deletion activity (reference: Sigma rule below).
Review IAM policies to ensure that only authorized users and roles have permissions to modify WAF configurations.
Implement multi-factor authentication (MFA) for all AWS accounts, especially those with privileged access.

AWS WAF Access Control List Deletion

hello@craftedsignal.io — Tue, 02 Jan 2024 10:00:00 +0000

This threat brief focuses on the detection of AWS Web Application Firewall (WAF) Web ACL deletion. AWS WAF protects web applications by filtering malicious HTTP/S traffic. A Web ACL acts as the central enforcement point, determining which traffic is inspected, allowed, or blocked. An attacker with sufficient privileges may delete a Web ACL to disable these protections. This action bypasses configured rules, protections, and logging, potentially leading to web-application compromise, data theft, or resource abuse. Because Web ACLs are critical security components, their deletion is rare and can signal malicious activity. This detection focuses on identifying successful DeleteWebACL events across WAF Classic, WAF Regional, and WAFv2 APIs in AWS CloudTrail logs.

Attack Chain

The attacker gains unauthorized access to an AWS account with sufficient IAM permissions to manage WAF resources, potentially through compromised credentials or privilege escalation.
The attacker authenticates to the AWS environment using the compromised credentials or assumed role.
The attacker uses the AWS CLI, SDK, or Management Console to issue a DeleteWebACL API call targeting a specific Web ACL.
The API call is successful, and the targeted Web ACL is removed from the AWS environment.
All rules, protections, and logging configurations associated with the deleted Web ACL are immediately disabled.
Web applications previously protected by the deleted Web ACL are now exposed to potentially malicious traffic without filtering or monitoring.
The attacker may then exploit vulnerabilities in the exposed web applications to gain unauthorized access or steal sensitive data.

Impact

The deletion of a Web ACL can have significant consequences. Applications previously protected by the Web ACL are exposed to direct exploitation. This could lead to web application compromise, data theft, or resource abuse. The number of affected applications depends on the scope of the deleted Web ACL. Successful exploitation can result in financial loss, reputational damage, and legal liabilities.

Recommendation

Enable AWS CloudTrail logging for all regions to capture API activity related to WAF configurations and deletions. Use data_stream.dataset: aws.cloudtrail and event.provider: (waf.amazonaws.com or waf-regional.amazonaws.com or wafv2.amazonaws.com) to filter logs (see query in this brief).
Deploy the Sigma rule to detect unauthorized Web ACL deletions and tune it to your environment, accounting for authorized deletions during maintenance windows or IaC deployments.
Restrict IAM permissions for waf:DeleteWebACL and wafv2:DeleteWebACL to a limited set of trusted roles, enforcing MFA for administrative access to prevent unauthorized deletions.
Monitor aws.cloudtrail.user_identity.arn and access_key_id in CloudTrail logs to identify the actor initiating the deletion and determine if the principal normally manages WAF resources (see investigation fields).