Skip to content
TheCloud.Events

DeleteNetworkAcl

AWS

DeleteNetworkAcl

service: AWS - EC2
tactics:
Defense Impairment
techniques:
T1686.001
tags:
AWS EC2

Event

Deletes a Network ACL from a VPC; the default NACL cannot be deleted.

Security Context

  • Modifying network security controls can open unauthorized access paths while removing evidence of the original restrictive configuration.

Log Source

CloudTrail

Sample Event

Adversarial. Draco deletes a custom NACL acl-0graph0rnsg0001 that was filtering traffic to the GRAPHORN management subnet, leaving subnets with only their security-group filtering. T1686.001.

{
  "eventVersion": "1.09",
  "userIdentity": {
    "type": "IAMUser",
    "principalId": "AIDADRAC0MALF0YBADGY",
    "arn": "arn:aws:iam::555123456789:user/draco",
    "accountId": "555123456789",
    "accessKeyId": "AKIADRAC0MALF0YEXAMP5",
    "userName": "draco",
    "sessionContext": {
      "attributes": {
        "creationDate": "2026-04-15T19:02:11Z",
        "mfaAuthenticated": "false"
      }
    }
  },
  "eventTime": "2026-04-15T19:27:48Z",
  "eventSource": "ec2.amazonaws.com",
  "eventName": "DeleteNetworkAcl",
  "awsRegion": "us-east-1",
  "sourceIPAddress": "203.0.113.66",
  "userAgent": "aws-cli/1.18.147 Python/3.7.10 Linux/5.4.0-1045-aws botocore/1.18.6",
  "requestParameters": {
    "networkAclId": "acl-0graph0rnsg0001"
  },
  "responseElements": {
    "requestId": "90000000-0000-4000-8000-000011110000",
    "_return": true
  },
  "requestID": "90000000-0000-4000-8000-000011110000",
  "eventID": "90000000-0000-4000-8000-000011110001",
  "readOnly": false,
  "eventType": "AwsApiCall",
  "managementEvent": true,
  "recipientAccountId": "555123456789",
  "eventCategory": "Management",
  "tlsDetails": {
    "tlsVersion": "TLSv1.3",
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "ec2.us-east-1.amazonaws.com"
  }
}

MITRE ATT&CK Mapping

Tactics: Defense Impairment

Techniques:
  • T1686.001 — Cloud Firewall — Adversaries may disable or modify a firewall within a cloud environment to bypass controls that limit access to cloud resources.
shares T1686.001 — Cloud Firewall
AuthorizeDBSecurityGroupIngress AuthorizeSecurityGroupEgress AuthorizeSecurityGroupIngress compute.firewalls.delete compute.firewalls.patch CreateNetworkAclEntry DeleteNetworkAclEntry Microsoft.Network/networkSecurityGroups/delete +1 more
same service (AWS - EC2)
AssociateIamInstanceProfile CreateImage CreateInstanceExportTask CreateKeyPair CreateSnapshot DeleteFlowLogs DeleteSnapshot DeleteVolume +10 more