AWS Credential Access RDS Password reset

Status: production
Severity: medium
Group by: aws::awsRegion, aws::recipientAccountId, aws::userAgent, dest, signature, src, user, vendor_product
Author: Gowthamaraj Rajendran, Splunk
Source: github.com/splunk/security_content

The following analytic detects the resetting of the master user password for an Amazon RDS DB instance. It leverages AWS CloudTrail logs to identify events where the ModifyDBInstance API call includes a new masterUserPassword parameter. This activity is significant because unauthorized password resets can grant attackers access to sensitive data stored in production databases, such as credit card information, PII, and healthcare data. If confirmed malicious, this could lead to data breaches, regulatory non-compliance, and significant reputational damage. Immediate investigation is required to determine the legitimacy of the password reset.

Known false positives

Users may genuinely reset the RDS password.

MITRE ATT&CK coverage

Tactic	Techniques
Resource Development	`T1586.003` Compromise Accounts: Cloud Accounts
Credential Access	`T1110` Brute Force

Telemetry coverage

Platform	Record / event type
AWS	CloudTrail event `ModifyDBInstance`: Modifies settings for a DB instance, including instance class, allocated storage, and multi-AZ configuration.

Rules detecting the same action

These rules filter on the same operation.

AWS RDS DB Instance Made Public (Elastic)
AWS RDS DB Instance or Cluster Deletion Protection Disabled (Elastic)
AWS RDS DB Instance or Cluster Password Modified (Elastic)
AWS RDS Deletion Protection Disabled (Panther)
AWS RDS Instance Modified to be Publicly Accessible (Panther)
AWS RDS Master Password Change (Sigma)
AWS RDS Master Password Updated (Panther)
AWS RDS Snapshot Deleted (Elastic)

Rule body

name: AWS Credential Access RDS Password reset
id: 6153c5ea-ed30-4878-81e6-21ecdb198189
version: 13
creation_date: '2022-08-07'
modification_date: '2026-05-13'
author: Gowthamaraj Rajendran, Splunk
status: production
type: TTP
description: The following analytic detects the resetting of the master user password for an Amazon RDS DB instance. It leverages AWS CloudTrail logs to identify events where the `ModifyDBInstance` API call includes a new `masterUserPassword` parameter. This activity is significant because unauthorized password resets can grant attackers access to sensitive data stored in production databases, such as credit card information, PII, and healthcare data. If confirmed malicious, this could lead to data breaches, regulatory non-compliance, and significant reputational damage. Immediate investigation is required to determine the legitimacy of the password reset.
data_source:
    - AWS CloudTrail ModifyDBInstance
search: |-
    `cloudtrail` eventSource="rds.amazonaws.com" eventName=ModifyDBInstance "requestParameters.masterUserPassword"=*
      | rename user_name as user
      | stats count min(_time) as firstTime max(_time) as lastTime values(requestParameters.dBInstanceIdentifier) as database_id
        BY signature dest user
           user_agent src vendor_account
           vendor_region vendor_product
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `aws_credential_access_rds_password_reset_filter`
how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs.
known_false_positives: Users may genuinely reset the RDS password.
references:
    - https://aws.amazon.com/premiumsupport/knowledge-center/reset-master-user-password-rds
finding:
    title: $database_id$ password has been reset from IP $src$
    entity:
        field: database_id
        type: system
        score: 50
threat_objects:
    - field: src
      type: ip_address
analytic_story:
    - AWS Identity and Access Management Account Takeover
    - Scattered Lapsus$ Hunters
asset_type: AWS Account
mitre_attack_id:
    - T1110
    - T1586.003
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: threat

Stages and Predicates

Stage 1: `search`

`cloudtrail` eventSource="rds.amazonaws.com" eventName=ModifyDBInstance "requestParameters.masterUserPassword"=*

Stage 2: `rename`

| rename user_name as user

Stage 3: `stats`

| stats count min(_time) as firstTime max(_time) as lastTime values(requestParameters.dBInstanceIdentifier) as database_id
    BY signature dest user
       user_agent src vendor_account
       vendor_region vendor_product

Stage 4: `search`

| `security_content_ctime(firstTime)`

Stage 5: `search`

| `security_content_ctime(lastTime)`

Stage 6: `search`

| `aws_credential_access_rds_password_reset_filter`

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`eventName`	eq	`ModifyDBInstance`	`field:"aws::eventName" kind:eq value:"ModifyDBInstance"`
`eventSource`	eq	`"rds.amazonaws.com"`	`field:"aws::eventSource" kind:eq`
`requestParameters.masterUserPassword`	eq	`*`	`field:"requestParameters.masterUserPassword" kind:eq value:"*"`
`sourcetype`	eq	`aws:cloudtrail`	`field:"sourcetype" kind:eq value:"aws:cloudtrail"`