Merge PR #5017 from @saakovv - Add `Modification or Deletion of an AW…

…S RDS Cluster` new: Modification or Deletion of an AWS RDS Cluster --------- Co-authored-by: Ivan.Saakov <[email protected]> Co-authored-by: nasbench <[email protected]> Co-authored-by: frack113 <[email protected]>
SigmaHQ · Dec 6, 2024 · 58017b6 · 58017b6
1 parent 6fd57da
commit 58017b6
Showing 1 changed file with 27 additions and 0 deletions.
diff --git a/rules/cloud/aws/cloudtrail/aws_rds_dbcluster_actions.yml b/rules/cloud/aws/cloudtrail/aws_rds_dbcluster_actions.yml
@@ -0,0 +1,27 @@
+title: Modification or Deletion of an AWS RDS Cluster
+id: 457cc9ac-d8e6-4d1d-8c0e-251d0f11a74c
+status: experimental
+description: Detects modifications to an RDS cluster or its deletion, which may indicate potential data exfiltration attempts, unauthorized access, or exposure of sensitive information.
+references:
+    - https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_ModifyDBCluster.html
+    - https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_DeleteDBCluster.html
+    - https://cloud.hacktricks.xyz/pentesting-cloud/aws-security/aws-privilege-escalation/aws-rds-privesc#rds-modifydbinstance
+author: Ivan Saakov
+date: 2024-12-06
+tags:
+    - attack.exfiltration
+    - attack.t1020
+logsource:
+    product: aws
+    service: cloudtrail
+detection:
+    selection:
+        eventSource: rds.amazonaws.com
+        eventName:
+            - ModifyDBCluster
+            - DeleteDBCluster
+    condition: selection
+falsepositives:
+    - Verify if the modification or deletion was performed by an authorized administrator.
+    - Confirm if the modification or deletion was part of a planned change or maintenance activity.
+level: high