[New Rule] AWS EC2 NACL Entry Created or Replaced Allowing All Traffic by New Identity

[bryans3c]

Pull Request

Issue link(s):

• https://github.com/elastic/ia-trade-team/issues/1042

Summary - What I changed

Added a new_terms rule that fires the first time a principal creates or replaces an AWS Network Access Control List (NACL) entry specifying protocol -1 (all traffic) that it has not performed in the last 7 days. IaC callers (Terraform, CloudFormation, Pulumi) are excluded via user-agent.

Why it matters

A NACL entry with protocol -1 passes all traffic regardless of port, effectively disabling network-layer controls for the affected subnets. This is a documented Defense Evasion technique (T1562.007: Disable or Modify Cloud Firewall). Keying on aws.cloudtrail.user_identity.arn as the new-terms field means the rule suppresses known IaC pipelines on first run and surfaces genuinely novel actors, the pattern most consistent with freshly compromised credentials being used to open a network path.

• https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_CreateNetworkAclEntry.html
• https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ReplaceNetworkAclEntry.html

How To Test

Query to verify in the TRaDE stack:

data_stream.dataset: "aws.cloudtrail"
    and event.provider: "ec2.amazonaws.com"
    and event.action: ("CreateNetworkAclEntry" or "ReplaceNetworkAclEntry")
    and event.outcome: "success"
    and not aws.cloudtrail.user_identity.type: "AWSService"
    and not user_agent.original: (*Terraform* or *terraform* or "cloudformation.amazonaws.com" or *pulumi* or *Pulumi*)
    and aws.cloudtrail.request_parameters: (*Protocol=-1* OR *protocol=-1*)

Checklist

• Added a label for the type of pr: Rule: New
• Secret and sensitive material has been managed correctly
• Automated testing was updated or added to match the most common scenarios
• Documentation and comments were added for features that require explanation

Contributor checklist

• Have you signed the contributor license agreement?
• Have you followed the contributor guidelines?

[github-actions]

Rule: New - Guidelines

These guidelines serve as a reminder set of considerations when proposing a new rule.

Documentation and Context

• Detailed description of the rule.
• List any new fields required in ECS/data sources.
• Link related issues or PRs.
• Include references.

Rule Metadata Checks

• creation_date matches the date of creation PR initially merged.
• min_stack_version should support the widest stack versions.
• name and description should be descriptive and not include typos.
• query should be inclusive, not overly exclusive, considering performance for diverse environments. Non ecs fields should be added to non-ecs-schema.json if not available in an integration.
• min_stack_comments and min_stack_version should be included if the rule is only compatible starting from a specific stack version.
• index pattern should be neither too specific nor too vague, ensuring it accurately matches the relevant data stream (e.g., use logs-endpoint.process-* for process data).
• integration should align with the index. If the integration is newly introduced, ensure the manifest, schemas, and new_rule.yaml template are updated.
• setup should include the necessary steps to configure the integration.
• note should include any additional information (e.g. Triage and analysis investigation guides, timeline templates).
• tags should be relevant to the threat and align/added to the EXPECTED_RULE_TAGS in the definitions.py file.
• threat, techniques, and subtechniques should map to ATT&CK always if possible.

New BBR Rules

• building_block_type should be included if the rule is a building block and the rule should be located in the rules_building_block folder.
• bypass_bbr_timing should be included if adding custom lookback timing to the rule.

Testing and Validation

• Provide evidence of testing and detecting the expected threat.
• Check for existence of coverage to prevent duplication.

[Copilot]

Pull request overview

Adds a new AWS CloudTrail new_terms detection rule intended to surface the first-time use of an identity that creates or replaces an EC2 Network ACL entry with protocol -1 (all traffic), which can indicate defensive control weakening.

Changes:

• Introduces a new new_terms rule for CreateNetworkAclEntry / ReplaceNetworkAclEntry events with protocol -1.
• Adds investigation guide content, false positive guidance, and MITRE ATT&CK mapping for T1562.007.

Comments suppressed due to low confidence (1)

rules/integrations/aws/defense_evasion_ec2_nacl_all_ports_open_new_identity.toml:81

• The rule name/description indicate the NACL entry is allowing all traffic, but the query only checks for protocol -1 and does not ensure ruleAction is allow. This can alert on deny rules (not actually opening traffic) and weaken signal fidelity; add an allow-action constraint (and consider using a looser protocol match to cover both flattened and JSON-shaped request parameters).

    and event.action: ("CreateNetworkAclEntry" or "ReplaceNetworkAclEntry")
    and event.outcome: "success"
    and not aws.cloudtrail.user_identity.type: "AWSService"
    and not user_agent.original: (*Terraform* or *terraform* or "cloudformation.amazonaws.com" or *pulumi* or *Pulumi*)
    and aws.cloudtrail.request_parameters: (*Protocol=-1* or *protocol=-1*)

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.

Comments suppressed due to low confidence (4)

rules/integrations/aws/defense_evasion_ec2_nacl_all_traffic_allowed_new_identity.toml:35

• The investigation guide states "all ports (0–65535) and all protocols", but the rule is keyed on protocol -1 plus ruleAction=allow and cidrBlock=0.0.0.0/0 (world-open IPv4). Updating this sentence to match the actual detection logic will make triage guidance more accurate.

This rule fires when a NACL entry specifying all ports (0–65535) and all protocols is created or replaced. While NACLs are stateless and secondary to security groups, a permissive NACL entry can neutralize a defense-in-depth layer and may indicate an adversary attempting to ensure unrestricted connectivity for their tools or exfiltration channels.

rules/integrations/aws/defense_evasion_ec2_nacl_all_traffic_allowed_new_identity.toml:40

• The investigation guide mentions both 0.0.0.0/0 and ::/0 as indicators, but the query only matches IPv4 (cidrBlock: 0.0.0.0/0). Either include IPv6 matching in the rule, or adjust the guidance to avoid implying the detection currently covers ::/0.

- Review `aws.cloudtrail.request_parameters` to identify the NACL ID, rule number, egress/ingress direction, and CIDR block (`0.0.0.0/0` or `::/0` for any-source rules are highest severity).

rules/integrations/aws/defense_evasion_ec2_nacl_all_traffic_allowed_new_identity.toml:15

• The description claims the NACL entry "passes all traffic regardless of port" but the rule is specifically filtering on an allow action and a world-open IPv4 CIDR (0.0.0.0/0). Updating the description to match the actual query conditions will avoid analyst confusion; this also removes a trailing whitespace character.

This issue also appears in the following locations of the same file:

• line 35
• line 40

Detects a principal account creating or replacing an AWS Network Access Control List (NACL)
entry using protocol -1 (all traffic). A NACL entry with protocol -1 passes all traffic regardless
of port, effectively disabling network-layer controls for the affected subnets. Monitoring for new
identities performing this change helps surface freshly compromised credentials or unauthorized
principals removing a defense-in-depth layer to facilitate lateral movement or data exfiltration. 

rules/integrations/aws/defense_evasion_ec2_nacl_all_traffic_allowed_new_identity.toml:80

• The PR summary and rule narrative describe detecting a principal creating/replacing a NACL entry, but the query currently includes failed events as well. Failed API calls didn't change a NACL and will likely add noise; consider restricting this to successful outcomes (or explicitly update the rule text to say it also alerts on attempts).

    and event.outcome: ("success" or "failure")