AWS EC2 NACL Entry Created or Replaced Allowing All Traffic by New Identity

Last updated 5 days ago on 2026-07-27

Created 5 days ago on 2026-07-27

About

Detects a principal account creating or replacing - or attempts to create or replace - an AWS Network Access Control List (NACL) entry using protocol -1 (all traffic). Both successful and failed outcomes are included. A NACL entry with protocol -1 passes all traffic regardless of port, which would disable network-layer controls for the affected subnets. Monitoring for new identities performing this change helps surface freshly compromised credentials or unauthorized principals removing a defense-in-depth layer to facilitate lateral movement or data exfiltration. This signal only flags if this behavior was not observed historically in a specific time window.

Tags

Domain: CloudData Source: AWSData Source: Amazon Web ServicesData Source: AWS EC2Use Case: Threat DetectionTactic: Defense EvasionLanguage: kuery

Severity

medium

Risk Score

MITRE ATT&CK™

Defense Evasion (TA0005)(external, opens in a new tab or window)

↳ Impair Defenses (T1562)(external, opens in a new tab or window)

False Positive Examples

Some legitimate architectures use permissive NACLs as a passthrough layer while relying on security groups for access control. Validate that the modified NACL is associated with subnets where this design pattern is expected and that the change was authorized through a change management process.

License

Elastic License v2(external, opens in a new tab or window)

Definition

Rule Type: New Terms Rule
Integration Pack: Prebuilt Security Detection Rules
Index Patterns: logs-aws.cloudtrail-*
Related Integrations: aws(external, opens in a new tab or window)
Query

✄𐘗text code block:
✄𐘗data_stream.dataset: "aws.cloudtrail"
    and event.provider: "ec2.amazonaws.com"
    and event.action: ("CreateNetworkAclEntry" or "ReplaceNetworkAclEntry")
    and not aws.cloudtrail.user_identity.type: "AWSService"
    and event.outcome: ("success" or "failure")
    and aws.cloudtrail.flattened.request_parameters.aclProtocol: "-1"
    and aws.cloudtrail.flattened.request_parameters.ruleAction: "allow"
    and not user_agent.original: (*Terraform* or *terraform* or "cloudformation.amazonaws.com" or *pulumi* or *Pulumi*)

Install detection rules in Elastic Security

Detect AWS EC2 NACL Entry Created or Replaced Allowing All Traffic by New Identity in the Elastic Security detection engine by installing this rule into your Elastic Stack.

To setup this rule, check out the installation guide for Prebuilt Security Detection Rules(external, opens in a new tab or window).