AnalysisType: rule
Filename: aws_network_acl_permissive_entry.py
RuleID: "AWS.CloudTrail.NetworkACLPermissiveEntry"
DisplayName: "AWS Network ACL Overly Permissive Entry Created"
Enabled: true
LogTypes:
- AWS.CloudTrail
Tags:
- AWS
- Persistence:Account Manipulation
Severity: Medium
Reports:
MITRE ATT&CK:
- TA0003:T1098
Description: >
A Network ACL entry that allows access from anywhere was added.
Runbook: >
Remove the overly permissive Network ACL entry and add a new entry with more restrictive permissions.
Reference: https://docs.aws.amazon.com/vpc/latest/userguide/vpc-network-acls.html#nacl-rules
SummaryAttributes:
- userAgent
- sourceIpAddress
- recipientAccountId
- p_any_aws_arns
Tests:
- Name: Overly Permissive Entry Added
ExpectedResult: true
Log:
{
"awsRegion": "us-west-2",
"eventID": "1111",
"eventName": "CreateNetworkAclEntry",
"eventSource": "ec2.amazonaws.com",
"eventTime": "2019-01-01T00:00:00Z",
"eventType": "AwsApiCall",
"eventVersion": "1.05",
"recipientAccountId": "123456789012",
"requestID": "1111",
"requestParameters":
{
"aclProtocol": "6",
"cidrBlock": "0.0.0.0/0",
"egress": false,
"icmpTypeCode": {},
"networkAclId": "acl-1111",
"portRange": { "from": 700, "to": 702 },
"ruleAction": "allow",
"ruleNumber": 12,
},
"responseElements": { "_return": true, "requestId": "1111" },
"sourceIPAddress": "111.111.111.111",
"userAgent": "Mozilla/2.0 (compatible; NEWT ActiveX; Win32)",
"userIdentity":
{
"accessKeyId": "1111",
"accountId": "123456789012",
"arn": "arn:aws:sts::123456789012:assumed-role/example-role/example-user",
"principalId": "1111",
"sessionContext":
{
"attributes":
{
"creationDate": "2019-01-01T00:00:00Z",
"mfaAuthenticated": "true",
},
"sessionIssuer":
{
"accountId": "123456789012",
"arn": "arn:aws:iam::123456789012:role/example-role",
"principalId": "1111",
"type": "Role",
"userName": "example-role",
},
"webIdFederationData": {},
},
"type": "AssumedRole",
},
}
- Name: Not Overly Permissive Entry Added
ExpectedResult: false
Log:
{
"awsRegion": "us-west-2",
"eventID": "1111",
"eventName": "CreateNetworkAclEntry",
"eventSource": "ec2.amazonaws.com",
"eventTime": "2019-01-01T00:00:00Z",
"eventType": "AwsApiCall",
"eventVersion": "1.05",
"recipientAccountId": "123456789012",
"requestID": "1111",
"requestParameters":
{
"aclProtocol": "6",
"cidrBlock": "111.111.111.111/32",
"egress": false,
"icmpTypeCode": {},
"networkAclId": "acl-1111",
"portRange": { "from": 700, "to": 702 },
"ruleAction": "allow",
"ruleNumber": 12,
},
"responseElements": { "_return": true, "requestId": "1111" },
"sourceIPAddress": "111.111.111.111",
"userAgent": "Mozilla/2.0 (compatible; NEWT ActiveX; Win32)",
"userIdentity":
{
"accessKeyId": "1111",
"accountId": "123456789012",
"arn": "arn:aws:sts::123456789012:assumed-role/example-role/example-user",
"principalId": "1111",
"sessionContext":
{
"attributes":
{
"creationDate": "2019-01-01T00:00:00Z",
"mfaAuthenticated": "true",
},
"sessionIssuer":
{
"accountId": "123456789012",
"arn": "arn:aws:iam::123456789012:role/example-role",
"principalId": "1111",
"type": "Role",
"userName": "example-role",
},
"webIdFederationData": {},
},
"type": "AssumedRole",
},
}
- Name: Error Adding Overly Permissive Entry
ExpectedResult: false
Log:
{
"awsRegion": "us-west-2",
"errorCode": "ValidationError",
"eventID": "1111",
"eventName": "CreateNetworkAclEntry",
"eventSource": "ec2.amazonaws.com",
"eventTime": "2019-01-01T00:00:00Z",
"eventType": "AwsApiCall",
"eventVersion": "1.05",
"recipientAccountId": "123456789012",
"requestID": "1111",
"requestParameters":
{
"aclProtocol": "6",
"cidrBlock": "0.0.0.0/0",
"egress": false,
"icmpTypeCode": {},
"networkAclId": "acl-1111",
"portRange": { "from": 700, "to": 702 },
"ruleAction": "allow",
"ruleNumber": 12,
},
"responseElements": { "_return": true, "requestId": "1111" },
"sourceIPAddress": "111.111.111.111",
"userAgent": "Mozilla/2.0 (compatible; NEWT ActiveX; Win32)",
"userIdentity":
{
"accessKeyId": "1111",
"accountId": "123456789012",
"arn": "arn:aws:sts::123456789012:assumed-role/example-role/example-user",
"principalId": "1111",
"sessionContext":
{
"attributes":
{
"creationDate": "2019-01-01T00:00:00Z",
"mfaAuthenticated": "true",
},
"sessionIssuer":
{
"accountId": "123456789012",
"arn": "arn:aws:iam::123456789012:role/example-role",
"principalId": "1111",
"type": "Role",
"userName": "example-role",
},
"webIdFederationData": {},
},
"type": "AssumedRole",
},
}
# ------ paired body: aws_network_acl_permissive_entry.py ------
from panther_aws_helpers import aws_cloudtrail_success, aws_rule_context
def rule(event):
# Only check successful actions creating a new Network ACL entry
if not aws_cloudtrail_success(event) or event.get("eventName") != "CreateNetworkAclEntry":
return False
# Check if this new NACL entry is allowing traffic from anywhere
return (
event.deep_get("requestParameters", "cidrBlock") == "0.0.0.0/0"
and event.deep_get("requestParameters", "ruleAction") == "allow"
and event.deep_get("requestParameters", "egress") is False
)
def alert_context(event):
return aws_rule_context(event)