AWS WAF web access control list modified

Classification:

attack

Tactic:

Technique:

このページは日本語には対応しておりません。随時翻訳に取り組んでいます。翻訳に関してご質問やご意見ございましたら、お気軽にご連絡ください。

Goal

Detect when an AWS Web Application Firewall (WAF) Access Control List (ACL) is updated.

The rule monitors AWS WAF logs @eventSource:waf*.amazonaws.com and detects when the @evt.name is UpdateWebACL.

Determine if {{@userIdentity.arn}} is expected to perform the {{@evt.name}} API call on the account: {{@userIdentity.accountId}}.
If the API call was not made legitimately by the user, rotate the user’s credentials and investigate what other APIs were successfully accessed.