AWS RDS DB Instance or Cluster Restored
Last updated on:
In this page
About the rule
Rule Type
Standard
Rule Description
An adversary with a set of compromised credentials may attempt to make copies of running or deleted RDS databases in order to evade defense mechanisms or access data. This rule identifies successful attempts to restore a DB instance using the RDSRestoreDBInstanceFromDBSnapshotorRestoreDBInstanceFromS3API operations.
Severity
Trouble
Rule Requirement
Criteria
Action1: actionname = "DETECTION_ACTION_AWS_RDS_DB_INSTANCE_OR_CLUSTER_RESTORED" select Action1.CALLER,Action1.HOSTNAME,Action1.IPADDRESS,Action1.LOG_EVENT_NAME,Action1.SOURCE,Action1.SOURCE_REGION,Action1.REQUESTPARAMETERS
Detection
Execution Mode
realtime
Log Sources
AWS
