name: AWS Network Access Control List Created with All Open Ports
id: ada0f478-84a8-4641-a3f1-d82362d6bd75
version: 2
date: '2021-01-11'
author: Bhavin Patel, Patrick Bareiss, Splunk
type: batch
datamodel: []
description: The search looks for CloudTrail events to detect if any network ACLs
  were created with all the ports open to a specified CIDR.
search: '`cloudtrail` eventName=CreateNetworkAclEntry OR eventName=ReplaceNetworkAclEntry
  requestParameters.ruleAction=allow requestParameters.egress=false requestParameters.aclProtocol=-1
  | append [search `cloudtrail` eventName=CreateNetworkAclEntry OR eventName=ReplaceNetworkAclEntry
  requestParameters.ruleAction=allow requestParameters.egress=false requestParameters.aclProtocol!=-1
  | eval port_range=''requestParameters.portRange.to'' - ''requestParameters.portRange.from''
  | where port_range>1024] | fillnull | stats count min(_time) as firstTime max(_time)
  as lastTime by userName userIdentity.principalId eventName requestParameters.ruleAction
  requestParameters.egress requestParameters.aclProtocol requestParameters.portRange.to
  requestParameters.portRange.from src userAgent requestParameters.cidrBlock | `security_content_ctime(firstTime)`|
  `security_content_ctime(lastTime)` | `aws_network_access_control_list_created_with_all_open_ports_filter`'
how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
  and Splunk Add-on for AWS, version 4.4.0 or later, and configure your CloudTrail
  inputs.
known_false_positives: It's possible that an admin has created this ACL with all ports
  open for some legitimate purpose however, this should be scoped and not allowed
  in production environment.
references: []
tags:
  analytic_story:
  - AWS Network ACL Activity
  asset_type: AWS Instance
  automated_detection_testing: passed
  cis20:
  - CIS 11
  dataset:
  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.007/aws_create_acl/aws_cloudtrail_events.json
  kill_chain_phases:
  - Actions on Objectives
  mitre_attack_id:
  - T1562.007
  nist:
  - DE.DP
  - DE.AE
  product:
  - Splunk Enterprise
  - Splunk Enterprise Security
  - Splunk Cloud
  required_fields:
  - _time
  - eventName
  - requestParameters.ruleAction
  - requestParameters.egress
  - requestParameters.aclProtocol
  - requestParameters.portRange.to
  - requestParameters.portRange.from
  - requestParameters.cidrBlock
  - userName
  - userIdentity.principalId
  - userAgent
  risk_object: userName
  risk_object_type: user
  risk_score: 10
  security_domain: network
