AWS CloudTrail: RestoreDBInstanceFromDBSnapshot Creates Public RDS Instance

Detects RDS restores from snapshots that result in a publicly accessible database instance in AWS CloudTrail.

FreeReviewedSigma · High · v5

Product: aws
Service: cloudtrail
Author: faloker (SigmaHQ), DRL 1.1
Published: 2020-02-12
Updated: 2026-07-31

ATT&CK techniques

Exfiltration

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
- T1020Automated Exfiltration
Impact

What it detects

This rule identifies CloudTrail events where an AWS RDS database instance is restored from a DB snapshot and marked as publicly accessible. Attackers can use public restoration to quickly expose a database for staging access during data theft or exfiltration workflows. The detection relies on CloudTrail fields indicating the RDS restore action and the resulting public accessibility setting.

Reporting behind it

Related detections9 linkedT1020 — drag to rearrange

Detect Email Forwarding/Redirecting via Exchange PowerShell InboxRule Cmdlets on Windows

AWS CloudTrail: RDS Cluster Modification or Deletion (ModifyDBCluster/DeleteDBCluster)

GitHub Audit Log: Repository or Organization Transfer Detected

GitHub Audit Logs: Private/Internal Forking Policy Enabled or Cleared

O365 Mail Forwarding and Redirecting Rule Changes

PowerShell Script Reading Files and Resolving DNS Host Entries

PowerShell script exfiltration using Invoke-WebRequest with POST or PUT

Microsoft 365 Cloud App Security Alerts on Suspicious Inbox Forwarding Rules

AWS CloudTrail RDS ModifyDBInstance Master User Password Change

AWS CloudTrail: RestoreDBInstanceFromDBSnapshot Creates Public RDS Instance

Pivot detection · T1020 · 9 related

Changelog

v5
Candidate ingested via manual entry.2026-07-31
v4
Candidate ingested via manual entry.2026-07-31
v3
Candidate ingested via manual entry.2026-07-31
v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

aws-cloudtrail-public-rds-instance-restored-from-snapshot-c3f265c7

title: "AWS CloudTrail: RestoreDBInstanceFromDBSnapshot Creates Public RDS Instance"
id: 1cde93f8-ea41-41f0-ad0f-679a575147df
status: test
description: This rule identifies CloudTrail events where an AWS RDS database instance is restored from a DB snapshot and marked as publicly accessible. Attackers can use public restoration to quickly expose a database for staging access during data theft or exfiltration workflows. The detection relies on CloudTrail fields indicating the RDS restore action and the resulting public accessibility setting.
references:
  - https://github.com/RhinoSecurityLabs/pacu/blob/866376cd711666c775bbfcde0524c817f2c5b181/pacu/modules/rds__explore_snapshots/main.py
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/aws/cloudtrail/aws_rds_public_db_restore.yml
author: faloker, Huntrule Team
date: 2020-02-12
modified: 2022-10-09
tags:
  - attack.exfiltration
  - attack.t1020
logsource:
  product: aws
  service: cloudtrail
detection:
  selection_source:
    eventSource: rds.amazonaws.com
    responseElements.publiclyAccessible: "true"
    eventName: RestoreDBInstanceFromDBSnapshot
  condition: selection_source
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: c3f265c7-ff03-4056-8ab2-d486227b4599
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL