AWS CloudTrail: RDS Cluster ModifyDBCluster or DeleteDBCluster Activity

Detects CloudTrail ModifyDBCluster or DeleteDBCluster actions on AWS RDS clusters.

FreeUnreviewedSigmahighv1

aws-cloudtrail-rds-cluster-modifydbcluster-or-deletedbcluster-activity-457cc9ac

title: "AWS CloudTrail: RDS Cluster ModifyDBCluster or DeleteDBCluster Activity"
id: 9b21048f-0f86-4572-8762-a472afbd17a3
status: experimental
description: This rule flags AWS CloudTrail events where an RDS cluster is modified or deleted via the ModifyDBCluster or DeleteDBCluster APIs. Such changes can indicate attempts to alter database configuration or remove data availability controls, potentially supporting unauthorized access or data exposure. It relies on CloudTrail telemetry for the rds.amazonaws.com eventSource and matching eventName values.
references:
  - https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_ModifyDBCluster.html
  - https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_DeleteDBCluster.html
  - https://cloud.hacktricks.xyz/pentesting-cloud/aws-security/aws-privilege-escalation/aws-rds-privesc#rds-modifydbinstance
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/aws/cloudtrail/aws_rds_dbcluster_actions.yml
author: Ivan Saakov, Huntrule Team
date: 2024-12-06
tags:
  - attack.exfiltration
  - attack.t1020
logsource:
  product: aws
  service: cloudtrail
detection:
  selection:
    eventSource: rds.amazonaws.com
    eventName:
      - ModifyDBCluster
      - DeleteDBCluster
  condition: selection
falsepositives:
  - Verify if the modification or deletion was performed by an authorized administrator.
  - Confirm if the modification or deletion was part of a planned change or maintenance activity.
level: high
license: DRL-1.1
related:
  - id: 457cc9ac-d8e6-4d1d-8c0e-251d0f11a74c
    type: derived

What it detects

This rule flags AWS CloudTrail events where an RDS cluster is modified or deleted via the ModifyDBCluster or DeleteDBCluster APIs. Such changes can indicate attempts to alter database configuration or remove data availability controls, potentially supporting unauthorized access or data exposure. It relies on CloudTrail telemetry for the rds.amazonaws.com eventSource and matching eventName values.

Known false positives

Verify if the modification or deletion was performed by an authorized administrator.
Confirm if the modification or deletion was part of a planned change or maintenance activity.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.