AWS RDS Master Password Change

Title: AWS RDS Master Password Change
Status: test
Description:Detects the change of database master password. It may be a part of data exfiltration.
References:
  -https://github.com/RhinoSecurityLabs/pacu/blob/866376cd711666c775bbfcde0524c817f2c5b181/pacu/modules/rds__explore_snapshots/main.py
Author: faloker
Date: 2020-02-12
modified:2022-10-05
Tags:

• -'attack.exfiltration'
• -'attack.t1020'

Logsource:

• product: aws
• service: cloudtrail

Detection:
  selection_source:
    eventSource: 'rds.amazonaws.com'
    responseElements.pendingModifiedValues.masterUserPassword|contains: '*'
    eventName: 'ModifyDBInstance'
  condition:selection_source
Falsepositives:
  -Benign changes to a db instance
Level: medium