AWS RDS master password changed
An RDS database instance or cluster was modified, which is the API that also resets the master user password and can make an instance publicly accessible.
What it detects
An RDS database instance or cluster was modified, which is the API that also resets the master user password and can make an instance publicly accessible.
Resetting the master password gives direct database access without needing the existing credential, and flipping PubliclyAccessible exposes the instance to the internet — two ways to reach the data that bypass the application entirely.
MITRE ATT&CK mapping
False positives and triage
ModifyDBInstance covers every instance change — resizing, maintenance windows, parameter groups — so most occurrences are ordinary database administration and this rule is context rather than a verdict. Read the request parameters: the signal is masterUserPassword being set, publiclyAccessible becoming true, or backup retention being reduced to zero. Escalate when the caller is not the usual database administrator.
The rule
Declarative YAML read by the detection engine — data, never executed. Confidence 55%. Source: rules/cloud/aws_rds_master_password_changed.yaml, licensed under the Apache License 2.0.
id: cloud.aws.rds_master_password_changed
version: 1.0.0
status: stable
severity: medium
confidence: 0.55
platforms: [application]
mitre_techniques: [T1110.002, T1098]
description: |
An RDS database instance or cluster was modified, which is the API that also
resets the master user password and can make an instance publicly accessible.
Resetting the master password gives direct database access without needing the
existing credential, and flipping `PubliclyAccessible` exposes the instance to the
internet — two ways to reach the data that bypass the application entirely.
match:
provider: AWS
event_action_any:
- ModifyDBInstance
- ModifyDBCluster
correlation_keys: [user_name]
false_positive_guidance: |
`ModifyDBInstance` covers every instance change — resizing, maintenance windows,
parameter groups — so most occurrences are ordinary database administration and
this rule is context rather than a verdict. Read the request parameters: the
signal is `masterUserPassword` being set, `publiclyAccessible` becoming true, or
backup retention being reduced to zero. Escalate when the caller is not the usual
database administrator.
Related detections
Run this rule on your own logs — offline
KIROSEC runs this rule and the rest of the library over Windows, Linux, macOS and cloud audit logs on the analyst's own machine. Every alert links to the events that raised it, and nothing leaves the device.