AWS RDS DB Instance Restored

An adversary with a set of compromised credentials may attempt to make copies of running or deleted RDS databases in order to evade defense mechanisms or access data. This rule identifies successful attempts to restore a DB instance using the RDS RestoreDBInstanceFromDBSnapshot or RestoreDBInstanceFromS3 API operations.

Rule type: eql

Rule indices:

filebeat-*
logs-aws.cloudtrail-*

Severity: medium

Risk score: 47

Runs every: 5m

Searches indices from: None (Date Math format, see also Additional look-back time)

Maximum alerts per execution: 100

References:

Tags:

Domain: Cloud
Data Source: AWS
Data Source: Amazon Web Services
Data Source: AWS RDS
Use Case: Asset Visibility
Tactic: Defense Evasion

Version: 207

Rule authors:

Austin Songer
Elastic

Rule license: Elastic License v2

Rule query

edit

any where event.dataset == "aws.cloudtrail"
    and event.provider == "rds.amazonaws.com"
    and event.action in ("RestoreDBInstanceFromDBSnapshot", "RestoreDBInstanceFromS3")
    and event.outcome == "success"

Framework: MITRE ATT&CK^TM

Tactic:
- Name: Defense Evasion
- ID: TA0005
- Reference URL: https://attack.mitre.org/tactics/TA0005/
Technique:
- Name: Modify Cloud Compute Infrastructure
- ID: T1578
- Reference URL: https://attack.mitre.org/techniques/T1578/
Sub-technique:
- Name: Create Cloud Instance
- ID: T1578.002
- Reference URL: https://attack.mitre.org/techniques/T1578/002/
Sub-technique:
- Name: Revert Cloud Instance
- ID: T1578.004
- Reference URL: https://attack.mitre.org/techniques/T1578/004/

« AWS RDS DB Instance Made Public AWS RDS DB Instance or Cluster Deletion Protection Disabled »