| name | detect-aws-open-security-group |
| description | Detect AWS Security Group ingress rules opened to the internet (0.0.0.0/0 or ::/0) on risky admin / database / cache / search ports. Reads OCSF 1.8 API Activity (class 6003) records emitted by ingest-cloudtrail-ocsf, fires on successful AuthorizeSecurityGroupIngress calls whose granted permissions cover any of the configured risky ports (default: SSH, RDP, MySQL, Postgres, Redis, Mongo, Cassandra, Kafka, Elasticsearch, etc.), and emits an OCSF 1.8 Detection Finding (class 2004) tagged with MITRE ATT&CK T1190 (Exploit Public-Facing Application). Use when the user mentions "detect open security groups," "AWS SG public exposure," "find internet-facing SG ingress," or "T1190 detection." Do NOT use as a remediator (pair with remediate-aws-sg-revoke), for GCP firewall rules (different shape — see #307 phase B), or as a posture check (CSPM evaluates state at rest; this detector fires on the create-event so response can be near-real-time). Out of scope: ICMP / non-IP protocols, VPC Network ACLs (different API surface), and intentionally-open exposures (operators tag those via SG tag `intentionally-open` and the paired remediator's deny-list refuses to revoke them). |
| purpose | Detect AWS Security Group ingress rules opened to the internet (0.0.0.0/0 or ::/0) on risky admin / database / cache / search ports. Reads OCSF 1.8 API Activity (class 6003) records emitted by ingest-cloudtrail-ocsf,... |
| capability | detect |
| persistence | none |
| telemetry | stderr_jsonl |
| privilege_escalation | none |
| license | Apache-2.0 |
| approval_model | none |
| execution_modes | jit, ci, mcp, persistent |
| side_effects | none |
| input_formats | ocsf |
| output_formats | native, ocsf |
| concurrency_safety | stateless |
| compatibility | Requires Python 3.11+. Read-only — consumes OCSF 1.8 API Activity records from stdin/file, emits OCSF 1.8 Detection Finding 2004 to stdout. No AWS SDK; pairs with the existing ingest-cloudtrail-ocsf upstream and the new remediate-aws-sg-revoke downstream. |
| metadata | {"author":"msaad00","homepage":"https://github.com/msaad00/cloud-ai-security-skills","source":"https://github.com/msaad00/cloud-ai-security-skills/tree/main/skills/detection/detect-aws-open-security-group","version":"0.1.0","frameworks":["OCSF 1.8","MITRE ATT&CK v14","CIS AWS Foundations"],"cloud":"aws","capability":"read-only"} |
detect-aws-open-security-group
Streaming detector for AWS Security Group ingress opened to the internet on risky ports. Pairs with remediate-aws-sg-revoke (closes #307 phase A's detection-side gap; the remediator closes the act-side).
Use when
- You stream CloudTrail through
ingest-cloudtrail-ocsf and want near-real-time T1190 findings
- You want a streaming alternative to the periodic CSPM check that catches SG exposures the moment they land
- You feed findings into the closed-loop remediator (
remediate-aws-sg-revoke)
Do NOT use
- For VPC Network ACL changes (different API surface)
- For GCP firewall or Azure NSG (separate detectors per #307 phases B + C)
- For ICMP-only or non-TCP/UDP protocol grants
- As a posture-at-rest scan (use the CSPM benchmark for that)
Rule
A finding fires on every AuthorizeSecurityGroupIngress event from ingest-cloudtrail-ocsf that:
- has
status_id == 1 (success)
- carries
requestParameters.ipPermissions[*] with at least one CIDR in {0.0.0.0/0, ::/0}
- covers at least one risky port (default list in
DEFAULT_RISKY_PORTS; protocol -1 or fromPort=-1 count as "all ports")
OCSF output
OCSF 1.8 Detection Finding (class 2004), severity HIGH (severity_id=4), with:
finding_info.attacks[].tactic_uid = TA0001 (Initial Access)finding_info.attacks[].technique_uid = T1190 (Exploit Public-Facing Application)observables[] includes target.uid (the SG id), target.name, target.type=SecurityGroup, account.uid, region, plus per-CIDR and per-port observables for the remediator to consume
The native projection (--output-format native) carries permission (the raw IpPermission item) for forensic context.
Run
python skills/ingestion/ingest-cloudtrail-ocsf/src/ingest.py raw.jsonl \
| python skills/detection/detect-aws-open-security-group/src/detect.py \
> findings.ocsf.jsonl
python skills/detection/detect-aws-open-security-group/src/detect.py findings-input.jsonl --output-format native
See also
