Possible RDS Snapshot exfiltration

cloudtrail

Classification:

attack

Tactic:

TA0010-exfiltration

Technique:

T1537-transfer-data-to-cloud-account

このページは日本語には対応しておりません。随時翻訳に取り組んでいます。翻訳に関してご質問やご意見ございましたら、お気軽にご連絡ください。

Goal

Detect a user attempting to exfiltrate data from an RDS Snapshot.

Strategy

This rule lets you monitor ModifyDBClusterSnapshotAttribute CloudTrail API calls to detect when an RDS snapshot is made public or shared with an AWS account.

This rule also inspects the:

  • @requestParameters.valuesToAdd array to determine if the string all is contained. This is the indicator which means the RDS snapshot is made public.
  • @requestParameters.attributeName array to determine if the string restore is contained. This is the indicator which means the RDS snapshot was shared with a new or unknown AWS Account.

Triage and response

  1. Confirm if the user: {{@userIdentity.arn}} intended to make the RDS snaphsot public.
  2. If the user did not make the API call:
    • Rotate the credentials.
    • Investigate if the same credentials made other unauthorized API calls.

Changelog

11 October 2022 - Updated severity.