Synopsis
Activation Period |
14 Days |
Training Period |
30 Days |
Test Period |
N/A (single event) |
Deduplication Period |
1 Day |
Required Data |
|
Detection Modules |
Cloud |
Detector Tags |
Data Detection & Response |
ATT&CK Tactic |
|
ATT&CK Technique |
|
Severity |
Low |
Description
An RDS snapshot was exported to an S3 bucket.
The destination S3 bucket was not seen in your organization in the last 30 days.
Attacker's Goals
Exfiltrate data to an unknown bucket.
Investigative actions
- Check the legitimacy of the referenced destination bucket.
- Review further logs for the source snapshot ID.
- Review further actions performed by the identity and role.
Variations
An RDS snapshot was exported to an unknown S3 bucket by an admin identityAn RDS snapshot was exported to an unknown S3 bucket while the snapshot contains sensitive data
An RDS snapshot was exported to an unknown S3 bucket - denied attempt