An RDS snapshot was exported to an unknown S3 bucket

Synopsis

Field	Value
Activation Period	14 Days
Training Period	30 Days
Test Period	N/A (single event)
Deduplication Period	1 Day
Required Data	AWS Audit Log
Detection Modules	Cloud
Detector Tags	Data Detection & Response
ATT&CK Tactic	Exfiltration (TA0010)
ATT&CK Technique	Transfer Data to Cloud Account (T1537)
Severity	Low

Description

An RDS snapshot was exported to an S3 bucket. The destination S3 bucket was not seen in your organization in the last 30 days.

Attacker's Goals

Exfiltrate data to an unknown bucket.

Investigative actions

• Check the legitimacy of the referenced destination bucket.
• Review further logs for the source snapshot ID.
• Review further actions performed by the identity and role.

Variations

An RDS snapshot was exported to an unknown S3 bucket by an admin identity

Synopsis

Field	Value
ATT&CK Tactic	Exfiltration (TA0010)
ATT&CK Technique	Transfer Data to Cloud Account (T1537)
Severity	Informational

Description

An RDS snapshot was exported to an S3 bucket. The destination S3 bucket was not seen in your organization in the last 30 days. The identity has an administrative behavior.

Attacker's Goals

Exfiltrate data to an unknown bucket.

Investigative actions

• Check the legitimacy of the referenced destination bucket.
• Review further logs for the source snapshot ID.
• Review further actions performed by the identity and role.

An RDS snapshot was exported to an unknown S3 bucket with suspicious indicators

Synopsis

Field	Value
ATT&CK Tactic	Exfiltration (TA0010)
ATT&CK Technique	Transfer Data to Cloud Account (T1537)
Severity	Medium

Description

An RDS snapshot was exported to an S3 bucket. The destination S3 bucket was not seen in your organization in the last 30 days.

Attacker's Goals

Exfiltrate data to an unknown bucket.

Investigative actions

• Check the legitimacy of the referenced destination bucket.
• Review further logs for the source snapshot ID.
• Review further actions performed by the identity and role.

An RDS snapshot was exported to an unknown S3 bucket - denied attempt

Synopsis

Field	Value
ATT&CK Tactic	Exfiltration (TA0010)
ATT&CK Technique	Transfer Data to Cloud Account (T1537)
Severity	Informational

Description

A denied attempt to export an RDS snapshot to an unknown S3 bucket.

Attacker's Goals

Exfiltrate data to an unknown bucket.

Investigative actions

• Check the legitimacy of the referenced destination bucket.
• Review further logs for the source snapshot ID.
• Review further actions performed by the identity and role.