Skip to content
TheCloud.Events

DeleteNetworkAclEntry

AWS

DeleteNetworkAclEntry

service: AWS - EC2
tactics:
Defense Impairment
techniques:
T1686.001
tags:
AWS EC2

Event

Removes a rule from a Network ACL, modifying traffic filtering for the associated VPC subnet.

Security Context

  • Modifying network security controls can open unauthorized access paths while removing evidence of the original restrictive configuration.

Log Source

CloudTrail

Sample Event

Adversarial. Draco removes an explicit-deny entry (rule 100, ingress) from the production NACL guarding the OCCAMY subnets — opening up the deny-list before he attempts lateral movement. T1686.001 (Cloud Firewall).

{
  "eventVersion": "1.09",
  "userIdentity": {
    "type": "IAMUser",
    "principalId": "AIDADRAC0MALF0YBADGY",
    "arn": "arn:aws:iam::555123456789:user/draco",
    "accountId": "555123456789",
    "accessKeyId": "AKIADRAC0MALF0YEXAMP5",
    "userName": "draco",
    "sessionContext": {
      "attributes": {
        "creationDate": "2026-04-15T19:02:11Z",
        "mfaAuthenticated": "false"
      }
    }
  },
  "eventTime": "2026-04-15T19:25:11Z",
  "eventSource": "ec2.amazonaws.com",
  "eventName": "DeleteNetworkAclEntry",
  "awsRegion": "us-east-1",
  "sourceIPAddress": "203.0.113.66",
  "userAgent": "aws-cli/1.18.147 Python/3.7.10 Linux/5.4.0-1045-aws botocore/1.18.6",
  "requestParameters": {
    "networkAclId": "acl-0occamy00000010",
    "ruleNumber": 100,
    "egress": false
  },
  "responseElements": {
    "requestId": "90000000-0000-4000-8000-000011101110",
    "_return": true
  },
  "requestID": "90000000-0000-4000-8000-000011101110",
  "eventID": "90000000-0000-4000-8000-000011101111",
  "readOnly": false,
  "eventType": "AwsApiCall",
  "managementEvent": true,
  "recipientAccountId": "555123456789",
  "eventCategory": "Management",
  "tlsDetails": {
    "tlsVersion": "TLSv1.3",
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "ec2.us-east-1.amazonaws.com"
  }
}

MITRE ATT&CK Mapping

Tactics: Defense Impairment

Techniques:
  • T1686.001 — Cloud Firewall — Adversaries may disable or modify a firewall within a cloud environment to bypass controls that limit access to cloud resources.
shares T1686.001 — Cloud Firewall
AuthorizeDBSecurityGroupIngress AuthorizeSecurityGroupEgress AuthorizeSecurityGroupIngress compute.firewalls.delete compute.firewalls.patch CreateNetworkAclEntry DeleteNetworkAcl Microsoft.Network/networkSecurityGroups/delete +1 more
same service (AWS - EC2)
AssociateIamInstanceProfile CreateImage CreateInstanceExportTask CreateKeyPair CreateSnapshot DeleteFlowLogs DeleteSnapshot DeleteVolume +10 more