Modification or Deletion of an AWS RDS Cluster

Status: experimental
Severity: high
Log source: product aws, service cloudtrail
Author: Ivan Saakov
Source: github.com/SigmaHQ/sigma

Detects modifications to an RDS cluster or its deletion, which may indicate potential data exfiltration attempts, unauthorized access, or exposure of sensitive information.

Known false positives

Verify if the modification or deletion was performed by an authorized administrator.
Confirm if the modification or deletion was part of a planned change or maintenance activity.

MITRE ATT&CK coverage

Tactic	Techniques
Exfiltration	`T1020` Automated Exfiltration

Telemetry coverage

Platform	Record / event type
AWS	CloudTrail event `DeleteDBCluster`: Deletes a previously provisioned DB cluster, including all automated backups if automated backups are enabled.
AWS	CloudTrail event `ModifyDBCluster`: Modifies settings for a DB cluster, including engine version, storage, and backup retention period.

Rules detecting the same action

These rules filter on the same operation.

AWS RDS DB Instance or Cluster Deleted (Elastic)
AWS RDS DB Instance or Cluster Deletion Protection Disabled (Elastic)
AWS RDS DB Instance or Cluster Password Modified (Elastic)
AWS RDS Deletion Protection Disabled (Panther)
AWS RDS Instance Modified to be Publicly Accessible (Panther)
AWS RDS Instance or Cluster Deleted (Panther)

Rule body

title: Modification or Deletion of an AWS RDS Cluster
id: 457cc9ac-d8e6-4d1d-8c0e-251d0f11a74c
status: experimental
description: Detects modifications to an RDS cluster or its deletion, which may indicate potential data exfiltration attempts, unauthorized access, or exposure of sensitive information.
references:
    - https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_ModifyDBCluster.html
    - https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_DeleteDBCluster.html
    - https://cloud.hacktricks.xyz/pentesting-cloud/aws-security/aws-privilege-escalation/aws-rds-privesc#rds-modifydbinstance
author: Ivan Saakov
date: 2024-12-06
tags:
    - attack.exfiltration
    - attack.t1020
logsource:
    product: aws
    service: cloudtrail
detection:
    selection:
        eventSource: rds.amazonaws.com
        eventName:
            - ModifyDBCluster
            - DeleteDBCluster
    condition: selection
falsepositives:
    - Verify if the modification or deletion was performed by an authorized administrator.
    - Confirm if the modification or deletion was part of a planned change or maintenance activity.
level: high

Stages and Predicates

Stage 0: `condition`

selection

Stage 1: `selection`

selection:
    eventSource: rds.amazonaws.com
    eventName:
        - ModifyDBCluster
        - DeleteDBCluster

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`eventName`	eq	`DeleteDBCluster` `ModifyDBCluster`	`field:"aws::eventName" kind:eq`
`eventSource`	eq	`rds.amazonaws.com`	`field:"aws::eventSource" kind:eq value:"rds.amazonaws.com"`