AWS CloudTrail: RDS Cluster Modification or Deletion (ModifyDBCluster/DeleteDBCluster)
Detects CloudTrail ModifyDBCluster or DeleteDBCluster actions on AWS RDS clusters.
- Product
- aws
- Service
- cloudtrail
- Author
- Ivan Saakov (SigmaHQ), DRL 1.1
- Published
- 2024-12-06
- Updated
- 2026-07-31
ATT&CK techniques
ExfiltrationRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags AWS CloudTrail events where an RDS DB cluster is modified or deleted. Such changes can be used to disrupt availability or alter database configuration in ways that may facilitate unauthorized access or exposure of sensitive data. Detection relies on CloudTrail telemetry capturing RDS API calls with eventSource rds.amazonaws.com and eventName values for ModifyDBCluster and DeleteDBCluster.
Reporting behind it
- docs.aws.amazon.comhttps://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_ModifyDBCluster.html
- docs.aws.amazon.comhttps://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_DeleteDBCluster.html
- cloud.hacktricks.xyzhttps://cloud.hacktricks.xyz/pentesting-cloud/aws-security/aws-privilege-escalation/aws-rds-privesc#rds-modifydbinstance
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/cloud/aws/cloudtrail/aws_rds_dbcluster_actions.yml
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "AWS CloudTrail: RDS Cluster Modification or Deletion (ModifyDBCluster/DeleteDBCluster)"
id: 9b21048f-0f86-4572-8762-a472afbd17a3
status: experimental
description: This rule flags AWS CloudTrail events where an RDS DB cluster is modified or deleted. Such changes can be used to disrupt availability or alter database configuration in ways that may facilitate unauthorized access or exposure of sensitive data. Detection relies on CloudTrail telemetry capturing RDS API calls with eventSource rds.amazonaws.com and eventName values for ModifyDBCluster and DeleteDBCluster.
references:
- https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_ModifyDBCluster.html
- https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_DeleteDBCluster.html
- https://cloud.hacktricks.xyz/pentesting-cloud/aws-security/aws-privilege-escalation/aws-rds-privesc#rds-modifydbinstance
- https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/aws/cloudtrail/aws_rds_dbcluster_actions.yml
author: Ivan Saakov, Huntrule Team
date: 2024-12-06
tags:
- attack.exfiltration
- attack.t1020
logsource:
product: aws
service: cloudtrail
detection:
selection:
eventSource: rds.amazonaws.com
eventName:
- ModifyDBCluster
- DeleteDBCluster
condition: selection
falsepositives:
- Verify if the modification or deletion was performed by an authorized administrator.
- Confirm if the modification or deletion was part of a planned change or maintenance activity.
level: high
license: DRL-1.1
related:
- id: 457cc9ac-d8e6-4d1d-8c0e-251d0f11a74c
type: derived