AWS CloudTrail RDS ModifyDBInstance Master User Password Change
Flags AWS RDS ModifyDBInstance events that include a master user password change.
- Product
- aws
- Service
- cloudtrail
- Author
- faloker (SigmaHQ), DRL 1.1
- Published
- 2020-02-12
- Updated
- 2026-07-31
ATT&CK techniques
ExfiltrationRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies CloudTrail events where an Amazon RDS DB instance is modified and the pending master user password field is present in the response. Attackers may change the RDS master password as part of data theft or post-access persistence to lock out legitimate credentials. The detection relies on AWS CloudTrail ModifyDBInstance telemetry and matching response elements that indicate the master password value was targeted for modification.
Reporting behind it
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: AWS CloudTrail RDS ModifyDBInstance Master User Password Change
id: 8c1a1505-ffb1-4205-be11-ce262cdcc44d
status: test
description: This rule identifies CloudTrail events where an Amazon RDS DB instance is modified and the pending master user password field is present in the response. Attackers may change the RDS master password as part of data theft or post-access persistence to lock out legitimate credentials. The detection relies on AWS CloudTrail ModifyDBInstance telemetry and matching response elements that indicate the master password value was targeted for modification.
references:
- https://github.com/RhinoSecurityLabs/pacu/blob/866376cd711666c775bbfcde0524c817f2c5b181/pacu/modules/rds__explore_snapshots/main.py
- https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/aws/cloudtrail/aws_rds_change_master_password.yml
author: faloker, Huntrule Team
date: 2020-02-12
modified: 2022-10-05
tags:
- attack.exfiltration
- attack.t1020
logsource:
product: aws
service: cloudtrail
detection:
selection_source:
eventSource: rds.amazonaws.com
responseElements.pendingModifiedValues.masterUserPassword|contains: "*"
eventName: ModifyDBInstance
condition: selection_source
falsepositives:
- Benign changes to a db instance
level: medium
license: DRL-1.1
related:
- id: 8a63cdd4-6207-414a-85bc-7e032bd3c1a2
type: derived