AWS CloudTrail: RDS Cluster Modification or Deletion (ModifyDBCluster/DeleteDBCluster)

title: "AWS CloudTrail: RDS Cluster Modification or Deletion (ModifyDBCluster/DeleteDBCluster)"
id: 9b21048f-0f86-4572-8762-a472afbd17a3
status: experimental
description: This rule flags AWS CloudTrail events where an RDS DB cluster is modified or deleted. Such changes can be used to disrupt availability or alter database configuration in ways that may facilitate unauthorized access or exposure of sensitive data. Detection relies on CloudTrail telemetry capturing RDS API calls with eventSource rds.amazonaws.com and eventName values for ModifyDBCluster and DeleteDBCluster.
references:
  - https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_ModifyDBCluster.html
  - https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_DeleteDBCluster.html
  - https://cloud.hacktricks.xyz/pentesting-cloud/aws-security/aws-privilege-escalation/aws-rds-privesc#rds-modifydbinstance
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/aws/cloudtrail/aws_rds_dbcluster_actions.yml
author: Ivan Saakov, Huntrule Team
date: 2024-12-06
tags:
  - attack.exfiltration
  - attack.t1020
logsource:
  product: aws
  service: cloudtrail
detection:
  selection:
    eventSource: rds.amazonaws.com
    eventName:
      - ModifyDBCluster
      - DeleteDBCluster
  condition: selection
falsepositives:
  - Verify if the modification or deletion was performed by an authorized administrator.
  - Confirm if the modification or deletion was part of a planned change or maintenance activity.
level: high
license: DRL-1.1
related:
  - id: 457cc9ac-d8e6-4d1d-8c0e-251d0f11a74c
    type: derived