AWS CloudTrail: RestoreDBInstanceFromDBSnapshot Creates Public RDS Instance
Detects RDS restores from snapshots that result in a publicly accessible database instance in AWS CloudTrail.
- Product
- aws
- Service
- cloudtrail
- Author
- faloker (SigmaHQ), DRL 1.1
- Published
- 2020-02-12
- Updated
- 2026-07-31
ATT&CK techniques
ExfiltrationRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies CloudTrail events where an AWS RDS database instance is restored from a DB snapshot and marked as publicly accessible. Attackers can use public restoration to quickly expose a database for staging access during data theft or exfiltration workflows. The detection relies on CloudTrail fields indicating the RDS restore action and the resulting public accessibility setting.
Reporting behind it
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "AWS CloudTrail: RestoreDBInstanceFromDBSnapshot Creates Public RDS Instance"
id: 1cde93f8-ea41-41f0-ad0f-679a575147df
status: test
description: This rule identifies CloudTrail events where an AWS RDS database instance is restored from a DB snapshot and marked as publicly accessible. Attackers can use public restoration to quickly expose a database for staging access during data theft or exfiltration workflows. The detection relies on CloudTrail fields indicating the RDS restore action and the resulting public accessibility setting.
references:
- https://github.com/RhinoSecurityLabs/pacu/blob/866376cd711666c775bbfcde0524c817f2c5b181/pacu/modules/rds__explore_snapshots/main.py
- https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/aws/cloudtrail/aws_rds_public_db_restore.yml
author: faloker, Huntrule Team
date: 2020-02-12
modified: 2022-10-09
tags:
- attack.exfiltration
- attack.t1020
logsource:
product: aws
service: cloudtrail
detection:
selection_source:
eventSource: rds.amazonaws.com
responseElements.publiclyAccessible: "true"
eventName: RestoreDBInstanceFromDBSnapshot
condition: selection_source
falsepositives:
- Unknown
level: high
license: DRL-1.1
related:
- id: c3f265c7-ff03-4056-8ab2-d486227b4599
type: derived