Cloud Security Group Rule Deleted via API

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•2

This rule detects attempts to delete a cloud security group rule via the AWS EC2 API. Specifically, it looks for HTTP traffic to 'ec2.amazonaws.com' with the URI containing 'RevokeSecurityGroupIngress', which is the API call used to remove an inbound rule from a security group.