AWS CloudTrail RDS ModifyDBInstance Master User Password Change

Flags AWS RDS ModifyDBInstance events that include a master user password change.

FreeUnreviewedSigmamediumv1

aws-cloudtrail-rds-modifydbinstance-master-user-password-change-8a63cdd4

title: AWS CloudTrail RDS ModifyDBInstance Master User Password Change
id: 8c1a1505-ffb1-4205-be11-ce262cdcc44d
status: test
description: This rule identifies CloudTrail events where an RDS database instance master user password is modified via ModifyDBInstance. Changing the master password can be used to establish or maintain unauthorized access while disrupting legitimate credentials. Detection relies on CloudTrail eventSource, eventName, and the presence of a pendingModifiedValues entry for masterUserPassword in responseElements.
references:
  - https://github.com/RhinoSecurityLabs/pacu/blob/866376cd711666c775bbfcde0524c817f2c5b181/pacu/modules/rds__explore_snapshots/main.py
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/aws/cloudtrail/aws_rds_change_master_password.yml
author: faloker, Huntrule Team
date: 2020-02-12
modified: 2022-10-05
tags:
  - attack.exfiltration
  - attack.t1020
logsource:
  product: aws
  service: cloudtrail
detection:
  selection_source:
    eventSource: rds.amazonaws.com
    responseElements.pendingModifiedValues.masterUserPassword|contains: "*"
    eventName: ModifyDBInstance
  condition: selection_source
falsepositives:
  - Benign changes to a db instance
level: medium
license: DRL-1.1
related:
  - id: 8a63cdd4-6207-414a-85bc-7e032bd3c1a2
    type: derived

What it detects

This rule identifies CloudTrail events where an RDS database instance master user password is modified via ModifyDBInstance. Changing the master password can be used to establish or maintain unauthorized access while disrupting legitimate credentials. Detection relies on CloudTrail eventSource, eventName, and the presence of a pendingModifiedValues entry for masterUserPassword in responseElements.

Known false positives

Benign changes to a db instance

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.