Detection rules › By event

AWS-rds

Event	Rules
AuthorizeDBSecurityGroupIngress	3
CreateDBCluster	1
CreateDBClusterSnapshot	1
CreateDBInstance	1
CreateDBSecurityGroup	2
CreateDBSnapshot	2
DeleteDBCluster	3
DeleteDBClusterSnapshot	2
DeleteDBInstance	2
DeleteDBSecurityGroup	2
DeleteDBSnapshot	2
DeleteGlobalCluster	1
DescribeDBInstances	1
DescribeDBSnapshots	2
ModifyDBCluster	6
ModifyDBClusterSnapshotAttribute	3
ModifyDBInstance	11
ModifyDBSnapshotAttribute	3
RestoreDBInstanceFromDBSnapshot	3
RestoreDBInstanceFromS3	1
RevokeDBSecurityGroupIngress	2
StartExportTask	2
AddRoleToDBCluster	1
AddRoleToDBInstance	1
CopyDBClusterSnapshot	1
CopyDBSnapshot	1
DeleteDBClusterAutomatedBackup	1
DeleteDBInstanceAutomatedBackup	1
DescribeDBClusterSnapshots	1
DownloadDBLogFilePortion	1
FailoverDBCluster	1
FailoverGlobalCluster	1
RebootDBCluster	1
RebootDBInstance	1
RebootDBShardGroup	1
StopActivityStream	1

AuthorizeDBSecurityGroupIngress

3 detection rules reference this event. View event page.

Sigma (1)

RDS Database Security Group Modification severity medium T1190

Kusto (1)

AWSCloudTrail - Changes to internet facing AWS RDS Database instances severity low T1098, T1098.001, T1685, T1686.001

Panther (1)

AWS RDS Security Group Ingress Authorized severity medium T1098, T1686.001

CreateDBCluster

1 detection rules reference this event. View event page.

Elastic (1)

AWS RDS DB Instance Made Public severity medium T1133, T1556, T1556.009

CreateDBClusterSnapshot

1 detection rules reference this event. View event page.

Elastic (1)

AWS RDS DB Snapshot Created severity low building block T1578, T1578.001

CreateDBInstance

1 detection rules reference this event. View event page.

Elastic (1)

AWS RDS DB Instance Made Public severity medium T1133, T1556, T1556.009

CreateDBSecurityGroup

2 detection rules reference this event. View event page.

Sigma (1)

RDS Database Security Group Modification severity medium T1190

Kusto (1)

AWSCloudTrail - Changes to internet facing AWS RDS Database instances severity low T1098, T1098.001, T1685, T1686.001

CreateDBSnapshot

2 detection rules reference this event. View event page.

Elastic (1)

AWS RDS DB Snapshot Created severity low building block T1578, T1578.001

Panther (1)

AWS RDS Manual/Public Snapshot Created severity low T1537

DeleteDBCluster

3 detection rules reference this event. View event page.

Sigma (1)

Modification or Deletion of an AWS RDS Cluster severity high T1020

Elastic (1)

AWS RDS DB Instance or Cluster Deleted severity medium T1485

Panther (1)

AWS RDS Instance or Cluster Deleted severity high T1485, T1531

DeleteDBClusterSnapshot

2 detection rules reference this event. View event page.

Elastic (1)

AWS RDS Snapshot Deleted severity medium T1485, T1490

Panther (1)

AWS RDS Snapshot Deleted severity high T1070, T1485

DeleteDBInstance

2 detection rules reference this event. View event page.

Elastic (1)

AWS RDS DB Instance or Cluster Deleted severity medium T1485

Panther (1)

AWS RDS Instance or Cluster Deleted severity high T1485, T1531

DeleteDBSecurityGroup

2 detection rules reference this event. View event page.

Sigma (1)

RDS Database Security Group Modification severity medium T1190

Kusto (1)

AWSCloudTrail - Changes to internet facing AWS RDS Database instances severity low T1098, T1098.001, T1685, T1686.001

DeleteDBSnapshot

2 detection rules reference this event. View event page.

Elastic (1)

AWS RDS Snapshot Deleted severity medium T1485, T1490

Panther (1)

AWS RDS Snapshot Deleted severity high T1070, T1485

DeleteGlobalCluster

1 detection rules reference this event. View event page.

Elastic (1)

AWS RDS DB Instance or Cluster Deleted severity medium T1485

DescribeDBInstances

1 detection rules reference this event. View event page.

Elastic (1)

AWS Discovery API Calls from VPN ASN for the First Time by Identity severity high T1526, T1580

DescribeDBSnapshots

2 detection rules reference this event. View event page.

Elastic (1)

AWS Discovery API Calls from VPN ASN for the First Time by Identity severity high T1526, T1580

Panther (1)

AWS RDS Snapshot Enumeration with Public or Shared Flag severity low T1580

ModifyDBCluster

6 detection rules reference this event. View event page.

Sigma (1)

Modification or Deletion of an AWS RDS Cluster severity high T1020

Elastic (2)

AWS RDS DB Instance or Cluster Deletion Protection Disabled severity medium T1485, T1578, T1578.005
AWS RDS DB Instance or Cluster Password Modified severity medium T1098, T1098.001

Splunk (1)

ASL AWS Credential Access RDS Password reset severity medium T1110, T1586, T1586.003

Panther (2)

AWS RDS Deletion Protection Disabled severity high T1490, T1685
AWS RDS Instance Modified to be Publicly Accessible severity critical T1098, T1133, T1686.001

ModifyDBClusterSnapshotAttribute

3 detection rules reference this event. View event page.

Elastic (1)

AWS RDS DB Snapshot Shared with Another Account severity medium T1537

YARA-L (1)

AWS RDS Snapshot Shared Publicly severity high T1537

Panther (1)

AWS RDS Snapshot Shared severity high T1537

ModifyDBInstance

11 detection rules reference this event. View event page.

Sigma (1)

AWS RDS Master Password Change severity medium T1020

Elastic (4)

AWS RDS DB Instance Made Public severity medium T1133, T1556, T1556.009
AWS RDS DB Instance or Cluster Deletion Protection Disabled severity medium T1485, T1578, T1578.005
AWS RDS DB Instance or Cluster Password Modified severity medium T1098, T1098.001
AWS RDS Snapshot Deleted severity medium T1485, T1490

Splunk (2)

ASL AWS Credential Access RDS Password reset severity medium T1110, T1586, T1586.003
AWS Credential Access RDS Password reset severity medium T1110, T1586, T1586.003

Kusto (1)

AWSCloudTrail - RDS instance publicly exposed severity medium T1537

Panther (3)

AWS RDS Deletion Protection Disabled severity high T1490, T1685
AWS RDS Instance Modified to be Publicly Accessible severity critical T1098, T1133, T1686.001
AWS RDS Master Password Updated severity low T1098

ModifyDBSnapshotAttribute

3 detection rules reference this event. View event page.

Elastic (1)

AWS RDS DB Snapshot Shared with Another Account severity medium T1537

YARA-L (1)

AWS RDS Snapshot Shared Publicly severity high T1537

Panther (1)

AWS RDS Snapshot Shared severity high T1537

RestoreDBInstanceFromDBSnapshot

3 detection rules reference this event. View event page.

Sigma (1)

Restore Public AWS RDS Instance severity high T1020

Elastic (1)

AWS RDS DB Instance Restored severity medium T1074, T1074.002, T1578, T1578.002, T1578.004

Panther (1)

AWS Public RDS Restore severity high T1020

RestoreDBInstanceFromS3

1 detection rules reference this event. View event page.

Elastic (1)

AWS RDS DB Instance Restored severity medium T1074, T1074.002, T1578, T1578.002, T1578.004

RevokeDBSecurityGroupIngress

2 detection rules reference this event. View event page.

Sigma (1)

RDS Database Security Group Modification severity medium T1190

Kusto (1)

AWSCloudTrail - Changes to internet facing AWS RDS Database instances severity low T1098, T1098.001, T1685, T1686.001

StartExportTask

2 detection rules reference this event. View event page.

Elastic (1)

AWS RDS Snapshot Export severity high T1213, T1213.006, T1567, T1567.002

Panther (1)

AWS RDS Snapshot Exported to S3 severity high T1537

AddRoleToDBCluster

1 detection rules reference this event. View event page.

Panther (1)

IAM Role Added to RDS Instance or Cluster severity medium T1078.004, T1098.001

AddRoleToDBInstance

1 detection rules reference this event. View event page.

Panther (1)

IAM Role Added to RDS Instance or Cluster severity medium T1078.004, T1098.001

CopyDBClusterSnapshot

1 detection rules reference this event. View event page.

Panther (1)

AWS RDS Snapshot Copied Cross-Region severity medium T1537

CopyDBSnapshot

1 detection rules reference this event. View event page.

Panther (1)

AWS RDS Snapshot Copied Cross-Region severity medium T1537

DeleteDBClusterAutomatedBackup

1 detection rules reference this event. View event page.

Panther (1)

AWS RDS Automated Backup Deleted severity critical T1485, T1490

DeleteDBInstanceAutomatedBackup

1 detection rules reference this event. View event page.

Panther (1)

AWS RDS Automated Backup Deleted severity critical T1485, T1490

DescribeDBClusterSnapshots

1 detection rules reference this event. View event page.

Panther (1)

AWS RDS Snapshot Enumeration with Public or Shared Flag severity low T1580

DownloadDBLogFilePortion

1 detection rules reference this event. View event page.

Panther (1)

AWS RDS Log File Downloaded severity low T1552.001

FailoverDBCluster

1 detection rules reference this event. View event page.

Panther (1)

AWS RDS Cluster Failover Initiated severity medium T1499

FailoverGlobalCluster

1 detection rules reference this event. View event page.

Panther (1)

AWS RDS Cluster Failover Initiated severity medium T1499

RebootDBCluster

1 detection rules reference this event. View event page.

Panther (1)

AWS RDS Instance or Cluster Rebooted severity medium T1499

RebootDBInstance

1 detection rules reference this event. View event page.

Panther (1)

AWS RDS Instance or Cluster Rebooted severity medium T1499

RebootDBShardGroup

1 detection rules reference this event. View event page.

Panther (1)

AWS RDS Instance or Cluster Rebooted severity medium T1499

StopActivityStream

1 detection rules reference this event. View event page.

Panther (1)

AWS RDS Activity Stream Stopped severity high T1685.002