AWS Security Group Ingress/Egress Rule Modification

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•34

Detects when an AWS account makes changes to the ingress or egress rules of a security group. This activity can indicate an attacker attempting to open new attack vectors, exfiltrate data over the network, or allow compromised machines to contact a command and control (C2) server.