Detection catalogue

Explore published rules with transparent provenance, licensing, and ATT&CK mappings.

detections

Loading detections…

New Network ACL Entry Added

Detects that network ACL entries have been added to a route table which could indicate that new attack vectors have been opened up in the AWS account.

ATT&CK coverage

Outside the enterprise matrix

T1686.001

Detection requirements

Log source product: aws
Log source service: cloudtrail

What the source says

What fires this without an attack behind it

Legitimate use of ACLs to enable customer and staff access from the public internet into a public VPC

References

https://www.gorillastack.com/blog/real-time-events/important-aws-cloudtrail-security-events-tracking/

Tagged by the source as

attack.defense-impairment

Detection logic

Published to signed-in readers

The query as its source wrote it, its canonical form, and the content hash that pins this exact revision.