From 9d4574b267f2b3a6c3d40982e0d5d52c062a477f Mon Sep 17 00:00:00 2001 From: Austin Songer Date: Tue, 22 Jun 2021 19:02:48 -0500 Subject: [PATCH] [New Rule] AWS RDS Instance Creation (#1269) Co-authored-by: Brent Murphy <56412096+bm11100@users.noreply.github.com> Co-authored-by: Brent Murphy --- .../persistence_rds_instance_creation.toml | 45 +++++++++++++++++++ 1 file changed, 45 insertions(+) create mode 100644 rules/aws/persistence_rds_instance_creation.toml diff --git a/rules/aws/persistence_rds_instance_creation.toml b/rules/aws/persistence_rds_instance_creation.toml new file mode 100644 index 000000000..687769cab --- /dev/null +++ b/rules/aws/persistence_rds_instance_creation.toml @@ -0,0 +1,45 @@ +[metadata] +creation_date = "2021/06/06" +maturity = "production" +updated_date = "2021/06/06" + +[rule] +author = ["Elastic"] +description = "Identifies the creation of an Amazon Relational Database Service (RDS) Aurora database instance." +false_positives = [ + """ + A database instance may be created by a system or network administrator. Verify whether the user identity, user + agent, and/or hostname should be making changes in your environment. Instances creations from unfamiliar users or + hosts should be investigated. If known behavior is causing false positives, it can be exempted from the rule. + """, +] +from = "now-60m" +index = ["filebeat-*", "logs-aws*"] +interval = "10m" +language = "kuery" +license = "Elastic License v2" +name = "AWS RDS Instance Creation" +note = """## Config + +The AWS Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.""" +references = ["https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_CreateDBInstance.html"] +risk_score = 21 +rule_id = "f30f3443-4fbb-4c27-ab89-c3ad49d62315" +severity = "low" +tags = ["Elastic", "Cloud", "AWS", "Continuous Monitoring", "SecOps", "Asset Visibility"] +timestamp_override = "event.ingested" +type = "query" + +query = ''' +event.dataset:aws.cloudtrail and event.provider:rds.amazonaws.com and event.action:CreateDBInstance and event.outcome:success +''' + + +[[rule.threat]] +framework = "MITRE ATT&CK" + +[rule.threat.tactic] +id = "TA0003" +name = "Persistence" +reference = "https://attack.mitre.org/tactics/TA0003/" +