Cloud security groups and firewall rules decide who can reach your instances. MITRE ATT&CK T1686.001, Cloud Firewall, covers adversaries who disable or modify them to bypass those limits. It belongs to Defense Impairment, a sub-technique of Disable or Modify System Firewall (T1686), and the platform is IaaS.
How attackers use it
MITRE explains that cloud environments usually run restrictive rules that allow only trusted IP addresses on expected ports. An adversary with the right permissions can add ingress rules to existing security groups or create new groups, which can open a path in and let them move from the cloud control plane to the data plane. The page gives an example of a script that adds rules allowing any TCP/IP connectivity to a cloud-hosted instance. They may also remove network limits to support activity such as cryptomining.
How to detect it
MITRE's detection strategy is to watch control plane logs for creation, deletion or modification of security groups and firewall rules that expand access beyond baseline. The telling cases are rules permitting 0.0.0.0/0 or opening atypical ports, especially when they line up with activity by a privileged role or API key.
How to reduce the risk
- Audit role permissions regularly so only expected users and roles can modify cloud firewalls.
- Apply least privilege to IAM policies.
Quick check
Which change is the strongest red flag in cloud audit logs?
A new rule permitting 0.0.0.0/0 or an unusual port, made by a privileged role or API key that does not normally manage networking.
