{"id":"14f3f1c8-02d5-43a2-a191-91ffb52d3015","title":"RDS Database Security Group Modification","description":"Detects changes to the security group entries for RDS databases.\nThis can indicate that a misconfiguration has occurred which potentially exposes the database to the public internet, a wider audience within the VPC or that removal of valid rules has occurred which could impact the availability of the database to legitimate services and users.\n","author":"jamesc-grafana","status":"test","level":"medium","date":"2024-07-11","modified":"","tags":["attack.initial-access","attack.t1190"],"technique_ids":["T1190"],"logsource":{"product":"aws","service":"cloudtrail"},"falsepositives":["Creation of a new Database that needs new security group rules"],"references":["https://www.gorillastack.com/blog/real-time-events/important-aws-cloudtrail-security-events-tracking/"],"source_path":"rules/cloud/aws/cloudtrail/aws_cloudtrail_security_group_change_rds.yml","source_sha256":"7d556a2914fb4c6ecc907a45b029d51084b05c26dfe00b0b610b99c92146fa72","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/cloud/aws/cloudtrail/aws_cloudtrail_security_group_change_rds.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: RDS Database Security Group Modification\nid: 14f3f1c8-02d5-43a2-a191-91ffb52d3015\nstatus: test\ndescription: |\n    Detects changes to the security group entries for RDS databases.\n    This can indicate that a misconfiguration has occurred which potentially exposes the database to the public internet, a wider audience within the VPC or that removal of valid rules has occurred which could impact the availability of the database to legitimate services and users.\nreferences:\n    - https://www.gorillastack.com/blog/real-time-events/important-aws-cloudtrail-security-events-tracking/\nauthor: jamesc-grafana\ndate: 2024-07-11\ntags:\n    - attack.initial-access\n    - attack.t1190\nlogsource:\n    product: aws\n    service: cloudtrail\ndetection:\n    selection:\n        eventSource: 'rds.amazonaws.com'\n        eventName:\n            - 'AuthorizeDBSecurityGroupIngress'\n            - 'CreateDBSecurityGroup'\n            - 'DeleteDBSecurityGroup'\n            - 'RevokeDBSecurityGroupIngress'\n    condition: selection\nfalsepositives:\n    - Creation of a new Database that needs new security group rules\nlevel: medium\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1190","id":"T1190","name":"Exploit Public-Facing Application","page":"techniques/enterprise/T1190/"}],"data_path":"data/detection-rules/14f3f1c8-02d5-43a2-a191-91ffb52d3015.json","kind":"sigma"}