LoFP / users may genuinely reset the rds password.

Techniques

• T1110
• T1586
• T1586.003

Sample rules

AWS Credential Access RDS Password reset

• source: splunk
• technicques:
  • T1586
  • T1586.003
  • T1110

Description

The master user password for Amazon RDS DB instance can be reset using the Amazon RDS console. Using this technique, the attacker can get access to the sensitive data from the DB. Usually, the production databases may have sensitive data like Credit card information, PII, Health care Data. This event should be investigated further.

Detection logic

`cloudtrail` eventSource="rds.amazonaws.com" eventName=ModifyDBInstance "requestParameters.masterUserPassword"=* 
| stats count min(_time) as firstTime max(_time) as lastTime values(requestParameters.dBInstanceIdentifier) as database_id by src awsRegion eventName userAgent user_arn
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)` 
| `aws_credential_access_rds_password_reset_filter`