huntrule

AWS RDS Security Group Changes via CloudTrail

Flags CloudTrail RDS events that create, delete, or change DB security group ingress rules.

FreeReviewedSigma · Medium · v5
Product
aws
Service
cloudtrail
Author
jamesc-grafana (SigmaHQ), DRL 1.1
Published
2024-07-11
Updated
2026-07-31
AnalysisDetection
title: AWS RDS Security Group Changes via CloudTrail
id: 813c296f-3af3-4616-816c-bc1e647781e8
status: test
description: This rule identifies CloudTrail events where RDS database security group settings are modified, including authorizing ingress, creating security groups, revoking ingress, and deleting security groups. Attackers and misconfigurations can use these actions to widen network access to a database or disrupt connectivity by removing or changing security group rules. The detection relies on CloudTrail eventSource and eventName telemetry for RDS API calls affecting database security group entries.
references:
  - https://www.gorillastack.com/blog/real-time-events/important-aws-cloudtrail-security-events-tracking/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/aws/cloudtrail/aws_cloudtrail_security_group_change_rds.yml
author: jamesc-grafana, Huntrule Team
date: 2024-07-11
tags:
  - attack.initial-access
  - attack.t1190
logsource:
  product: aws
  service: cloudtrail
detection:
  selection:
    eventSource: rds.amazonaws.com
    eventName:
      - AuthorizeDBSecurityGroupIngress
      - CreateDBSecurityGroup
      - DeleteDBSecurityGroup
      - RevokeDBSecurityGroupIngress
  condition: selection
falsepositives:
  - Creation of a new Database that needs new security group rules
level: medium
license: DRL-1.1
related:
  - id: 14f3f1c8-02d5-43a2-a191-91ffb52d3015
    type: derived