AWS CloudTrail: Public RDS Instance Restored from Snapshot

Detects RDS restores from snapshots that result in a publicly accessible database instance in AWS CloudTrail.

FreeUnreviewedSigmahighv1

aws-cloudtrail-public-rds-instance-restored-from-snapshot-c3f265c7

title: "AWS CloudTrail: Public RDS Instance Restored from Snapshot"
id: 1cde93f8-ea41-41f0-ad0f-679a575147df
status: test
description: This rule flags CloudTrail events where an AWS RDS instance is restored from a DB snapshot and the resulting instance is publicly accessible. Making a restored database public can be used to expose data or facilitate follow-on access after snapshot-based staging. The detection relies on CloudTrail fields for the RDS API event name and the publiclyAccessible value in the response.
references:
  - https://github.com/RhinoSecurityLabs/pacu/blob/866376cd711666c775bbfcde0524c817f2c5b181/pacu/modules/rds__explore_snapshots/main.py
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/aws/cloudtrail/aws_rds_public_db_restore.yml
author: faloker, Huntrule Team
date: 2020-02-12
modified: 2022-10-09
tags:
  - attack.exfiltration
  - attack.t1020
logsource:
  product: aws
  service: cloudtrail
detection:
  selection_source:
    eventSource: rds.amazonaws.com
    responseElements.publiclyAccessible: "true"
    eventName: RestoreDBInstanceFromDBSnapshot
  condition: selection_source
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: c3f265c7-ff03-4056-8ab2-d486227b4599
    type: derived

What it detects

This rule flags CloudTrail events where an AWS RDS instance is restored from a DB snapshot and the resulting instance is publicly accessible. Making a restored database public can be used to expose data or facilitate follow-on access after snapshot-based staging. The detection relies on CloudTrail fields for the RDS API event name and the publiclyAccessible value in the response.

Known false positives

Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.