An RDS snapshot was exported to an unknown bucket

Synopsis

Field	Value
Activation Period	14 Days
Training Period	30 Days
Test Period	N/A (single event)
Deduplication Period	1 Day
Required Data	AWS Audit Log
Detection Modules	Cloud
Detector Tags	Data Detection & Response, Cloud Data Asset Exfiltration
ATT&CK Tactic	Exfiltration (TA0010)
ATT&CK Technique	Transfer Data to Cloud Account (T1537)
Severity	Informational

Description

An RDS snapshot was exported to an unknown S3 bucket. The destination bucket has not been seen in your tenant in the last 30 days.

Attacker's Goals

Exfiltrate data to an unknown bucket.

Investigative actions

• Check the legitimacy of the destination bucket.
• Review further logs for the source RDS instance.
• Review further actions performed by the identity.

Variations

Failed RDS snapshot export attempt to an unknown bucket

Synopsis

Field	Value
ATT&CK Tactic	Exfiltration (TA0010)
ATT&CK Technique	Transfer Data to Cloud Account (T1537)
Severity	Informational

Description

A failed attempt to export an RDS snapshot to an unknown bucket.

Attacker's Goals

Exfiltrate data to an unknown bucket.

Investigative actions

• Check the legitimacy of the destination bucket.
• Review further logs for the source RDS instance.
• Review further actions performed by the identity.