Techniques › T1686.001 › AN1188
AN1188 Analytic 1188
IaaS · attack.mitre.org · ATT&CK Enterprise v19.2
<p>Creation, deletion, or modification of security groups and firewall rules in cloud control plane logs that expand access to cloud resources beyond expected baselines. Defender view: unexpected ingress/egress rules permitting 0.0.0.0/0 or opening atypical ports, often correlated with privileged role or API key activity.</p>
- Detects
- T1686.001 Cloud Firewall
- Part of
- DET0424 Detection Strategy for Disable or Modify Cloud Firewall
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|---|---|
| AWS:CloudTrail | Ingress rule creation or modification for security group | DC0051 Firewall Rule Modification |
| AWS:CloudTrail | Removal of restrictive egress rules from a security group | DC0043 Firewall Disable |
Mutable elements
Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.
| Field | Description |
|---|---|
AllowedIPRanges | Whitelist approved IP ranges; detect unexpected addition of 0.0.0.0/0 or untrusted CIDRs. |
PortScope | Define expected ports for services; flag additions outside this range (e.g., SSH/RDP open to all). |
RoleContext | Tune alerts based on whether changes are made by break-glass or admin roles versus automation accounts. |
TimeWindow | Correlate rule changes with subsequent suspicious network activity to reduce false positives. |