rules/cloud/aws/aws_rds_change_master_password.yml

title: AWS RDS Master Password Change
id: 8a63cdd4-6207-414a-85bc-7e032bd3c1a2
status: experimental
description: Detects the change of database master password. It may be a part of data exfiltration.
author: faloker
date: 2020/02/12
modified: 2021/08/20
references:
    - https://github.com/RhinoSecurityLabs/pacu/blob/master/pacu/modules/rds__explore_snapshots/main.py
logsource:
    product: aws
    service: cloudtrail
detection:
    selection_source:
        eventSource: rds.amazonaws.com
        responseElements.pendingModifiedValues.masterUserPassword: '*'
        eventName: ModifyDBInstance
    condition: selection_source
falsepositives:
    - Benign changes to a db instance
level: medium
tags:
    - attack.exfiltration
    - attack.t1020
Update rules titles 2020-02-12 23:09:16 +02:00			`title: AWS RDS Master Password Change`
Add rules to detect AWS RDS exfiltration 2020-02-12 22:21:52 +02:00			`id: 8a63cdd4-6207-414a-85bc-7e032bd3c1a2`
			`status: experimental`
Fixed my git issue 2020-09-13 22:03:04 -06:00			`description: Detects the change of database master password. It may be a part of data exfiltration.`
Add rules to detect AWS RDS exfiltration 2020-02-12 22:21:52 +02:00			`author: faloker`
			`date: 2020/02/12`
Update AWS CloudTrail rules 2021-08-20 13:43:00 +01:00			`modified: 2021/08/20`
Add rules to detect AWS RDS exfiltration 2020-02-12 22:21:52 +02:00			`references:`
Update AWS CloudTrail rules 2021-08-20 13:43:00 +01:00			`- https://github.com/RhinoSecurityLabs/pacu/blob/master/pacu/modules/rds__explore_snapshots/main.py`
Add rules to detect AWS RDS exfiltration 2020-02-12 22:21:52 +02:00			`logsource:`
$frack113$ Add product aws 2021-11-14 09:56:59 +01:00			`product: aws`
Correct the indentation 2020-02-12 22:48:46 +02:00			`service: cloudtrail`
Add rules to detect AWS RDS exfiltration 2020-02-12 22:21:52 +02:00			`detection:`
Correct the indentation 2020-02-12 22:48:46 +02:00			`selection_source:`
$frack113$ split PR 1802 fix rules 2021-08-09 15:41:40 +02:00			`eventSource: rds.amazonaws.com`
$frack113$ Change double quote to quote 2022-01-06 14:02:35 +01:00			`responseElements.pendingModifiedValues.masterUserPassword: '*'`
$frack113$ split PR 1802 fix rules 2021-08-09 15:41:40 +02:00			`eventName: ModifyDBInstance`
			`condition: selection_source`
Add rules to detect AWS RDS exfiltration 2020-02-12 22:21:52 +02:00			`falsepositives:`
			`- Benign changes to a db instance`
Fixed my git issue 2020-09-13 22:03:04 -06:00			`level: medium`
Add rules to detect AWS RDS exfiltration 2020-02-12 22:21:52 +02:00			`tags:`
att&ck tags review: application, apt, cloud, generic, proxy 2020-09-03 14:16:47 +00:00			`- attack.exfiltration`
Correct the indentation 2020-02-12 22:48:46 +02:00			`- attack.t1020`