This rule detects creation or replacement of an AWS Network ACL (NACL) entry that permits all traffic (protocol -1) by a principal identity that is not an AWS service, capturing both successful and failed attempts. It focuses on CloudTrail events CreateNetworkAclEntry or ReplaceNetworkAclEntry where the aclProtocol is "-1" and the ruleAction is "allow" for all ports (0-65535) and for source/destination 0.0.0.0/0. The detection window is constrained to a historical lookback (new identity not observed in history_window_start, e.g., now-7d), and triggers on events within a refresh interval (e.g., from now-6m with 5m cadence). The rule uses fields such as aws.cloudtrail.user_identity.arn, aws.cloudtrail.flattened.request_parameters.aclId, aws.cloudtrail.flattened.request_parameters.ruleAction, and event.outcome to identify who made the change and whether it succeeded or failed. It maps to DEFENSE Evation through MITRE ATT&CK T1562.007 (Disable or Modify Cloud Firewall). The plan includes triage steps to verify authorization, examine NACL and subnet associations, check for accompanying security group changes, and review VPC flow logs for relevant activity. If unauthorized, the remediation is to remove or restrict the permissive entry, seal the subnet’s exposure, and audit for credential compromise. False positives include legitimate architectures using permissive NACLs for passthrough or development environments. This rule relies on CloudTrail being enabled and properly configured to capture EC2 network-management events.