Sigma medium test sigma

AWS RDS Master Password Change

Detects the change of database master password. It may be a part of data exfiltration.

View Source

Detection Logic

{
  "selection_source": {
    "eventSource": "rds.amazonaws.com",
    "responseElements.pendingModifiedValues.masterUserPassword
| contains": "*",
    "eventName": "ModifyDBInstance"
  },
  "condition": "selection_source"
}

False Positives

  • ⚠ Benign changes to a db instance

Field Validations

Loading…

Comments (0)

Loading comments...