Restore Public AWS RDS Instance

Title: Restore Public AWS RDS Instance
Status: test
Description:Detects the recovery of a new public database instance from a snapshot. It may be a part of data exfiltration.
References:
  -https://github.com/RhinoSecurityLabs/pacu/blob/866376cd711666c775bbfcde0524c817f2c5b181/pacu/modules/rds__explore_snapshots/main.py
Author: faloker
Date: 2020-02-12
modified:2022-10-09
Tags:

• -'attack.exfiltration'
• -'attack.t1020'

Logsource:

• product: aws
• service: cloudtrail

Detection:
  selection_source:
    eventSource: 'rds.amazonaws.com'
    responseElements.publiclyAccessible: 'true'
    eventName: 'RestoreDBInstanceFromDBSnapshot'
  condition:selection_source
Falsepositives:
  -Unknown
Level: high