Sunturai
Back to results
InformationalSplunk security contentBhavin Patel +2

AWS Network Access Control List Deleted

The following analytic detects the deletion of AWS Network Access Control Lists (ACLs). It leverages AWS CloudTrail logs to identify events where a user deletes a network ACL entry. This activity is significant…

Description

The following analytic detects the deletion of AWS Network Access Control Lists (ACLs). It leverages AWS CloudTrail logs to identify events where a user deletes a network ACL entry. This activity is significant because deleting a network ACL can remove critical access restrictions, potentially allowing unauthorized access to cloud instances. If confirmed malicious, this action could enable attackers to bypass network security controls, leading to unauthorized access, data exfiltration, or further compromise of the cloud environment.

Detection logic

Detection requirements

Platform
IaaS

The rule states no platform. This is derived from the ATT&CK technique it maps to.

Log source category
aws_cloudtrail_deletenetworkaclentry

Known benign triggers

  • It's possible that a user has legitimately deleted a network ACL.

Detections can measure how the public catalogue is used — which detections people look for, and which pages bring them here. It sets a cookie that recognises this browser for 180 days. It is never linked to an account and never follows you to other sites. Privacy notice