aws-waf-tamper-regex-set

Modify a Regex Pattern Set to remove blocking patterns or add permissive ones (defense evasion with blast radius tied to referencing Web ACLs).

derived aws emits CanModify

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

where

emit

source type	`Identity`
target type	`GenericManagement`
source	`?principal`
target	`?patternset`
permissions	`wafv2:UpdateRegexPatternSet`
conditions	`iam_permission` `scp_or_org_policy`
state logic	ACTIVE when wafv2:UpdateRegexPatternSet is confirmed effective. Blast radius materializes only if the Pattern Set is referenced by at least one Web ACL in an active association — if referenced by zero ACLs (orphaned), downgrade to POTENTIAL or annotate low impact. BLOCKED if an SCP or permission boundary denies wafv2:UpdateRegexPatternSet.

source type

Identity

target type

GenericManagement

source

?principal

target

?patternset

permissions

wafv2:UpdateRegexPatternSet

conditions

iam_permission scp_or_org_policy

state logic

ACTIVE when wafv2:UpdateRegexPatternSet is confirmed effective. Blast radius materializes only if the Pattern Set is referenced by at least one Web ACL in an active association — if referenced by zero ACLs (orphaned), downgrade to POTENTIAL or annotate low impact. BLOCKED if an SCP or permission boundary denies wafv2:UpdateRegexPatternSet.

Narrative

{principal.name} can modify the Regex Pattern Set {patternset.name} (wafv2:UpdateRegexPatternSet). Removing malicious regex patterns from block lists or adding permissive patterns to allow lists would weaken HTTP-layer filtering for all Web ACLs that reference this set. This reduces detection coverage and may allow previously-blocked traffic - it is a cover-tracks / weaken-defenses action, not an access grant.

Raw rule rules/derived/aws/waf.yaml

id: aws-waf-tamper-regex-set
emits: CanModify
description: Modify a Regex Pattern Set to remove blocking patterns or add permissive ones (defense evasion
  with blast radius tied to referencing Web ACLs).
applies_to:
- aws
match:
- - principal: null
  - HasPermission
  - patternset: null
where:
- node_type(?patternset) == GenericManagement
- ?patternset.provider_type == 'AWS::WAFv2::RegexPatternSet'
- effective_action_on(?principal, ?patternset) contains 'wafv2:UpdateRegexPatternSet'
emit:
  source_type: Identity
  target_type: GenericManagement
  source: ?principal
  target: ?patternset
  permissions:
  - wafv2:UpdateRegexPatternSet
  conditions:
  - iam_permission
  - scp_or_org_policy
  state_logic: "ACTIVE when wafv2:UpdateRegexPatternSet is confirmed effective. Blast radius materializes\
    \ only if the Pattern Set is referenced by at least one Web ACL in an active association \u2014 if\
    \ referenced by zero ACLs (orphaned), downgrade to POTENTIAL or annotate low impact. BLOCKED if an\
    \ SCP or permission boundary denies wafv2:UpdateRegexPatternSet."
  confidence: 0.85
  derived_from:
  - ?principal HasPermission ?patternset (wafv2:UpdateRegexPatternSet)
  false_positive_note: "Regex Pattern Sets are referenced by Web ACL rules as match conditions. Removing\
    \ malicious patterns from a block list or adding permissive patterns to an allow list changes HTTP\
    \ filtering for all consuming ACLs. This edge is defense evasion, NOT privilege escalation \u2014\
    \ do NOT chain to CanEnterAccount / CanExecuteAs / CanEscalateTo. Blast radius is zero if the Pattern\
    \ Set has no referencing Web ACLs."
  narrative: "{principal.name} can modify the Regex Pattern Set {patternset.name} (wafv2:UpdateRegexPatternSet).\
    \ Removing malicious regex patterns from block lists or adding permissive patterns to allow lists\
    \ would weaken HTTP-layer filtering for all Web ACLs that reference this set. This reduces detection\
    \ coverage and may allow previously-blocked traffic \u2014 it is a cover-tracks / weaken-defenses\
    \ action, not an access grant."