AWS RDS Security Group Rule Changes via CloudTrail

Flags CloudTrail RDS events that create, delete, or change DB security group ingress rules.

FreeUnreviewedSigmamediumv1

aws-rds-security-group-rule-changes-via-cloudtrail-14f3f1c8

title: AWS RDS Security Group Rule Changes via CloudTrail
id: 813c296f-3af3-4616-816c-bc1e647781e8
status: test
description: This rule identifies RDS security group changes in AWS CloudTrail, including authorizing and revoking inbound rules and creating or deleting DB security groups. Attackers may use these actions to open database access to unintended sources, broaden connectivity within the VPC, or remove existing rules that legitimate clients rely on. The detection relies on CloudTrail events with the RDS event source and the specific RDS API event names listed in the rule.
references:
  - https://www.gorillastack.com/blog/real-time-events/important-aws-cloudtrail-security-events-tracking/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/aws/cloudtrail/aws_cloudtrail_security_group_change_rds.yml
author: jamesc-grafana, Huntrule Team
date: 2024-07-11
tags:
  - attack.initial-access
  - attack.t1190
logsource:
  product: aws
  service: cloudtrail
detection:
  selection:
    eventSource: rds.amazonaws.com
    eventName:
      - AuthorizeDBSecurityGroupIngress
      - CreateDBSecurityGroup
      - DeleteDBSecurityGroup
      - RevokeDBSecurityGroupIngress
  condition: selection
falsepositives:
  - Creation of a new Database that needs new security group rules
level: medium
license: DRL-1.1
related:
  - id: 14f3f1c8-02d5-43a2-a191-91ffb52d3015
    type: derived

What it detects

This rule identifies RDS security group changes in AWS CloudTrail, including authorizing and revoking inbound rules and creating or deleting DB security groups. Attackers may use these actions to open database access to unintended sources, broaden connectivity within the VPC, or remove existing rules that legitimate clients rely on. The detection relies on CloudTrail events with the RDS event source and the specific RDS API event names listed in the rule.

Known false positives

Creation of a new Database that needs new security group rules

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.