RDS instance master password changed

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · 📊

Back to Content Index


Detected change of the RDS Master password. Verify if this was intentional, or if it was caused by a malicious actor.

Attribute Value
Type Hunting Query
Solution Amazon Web Services
ID b9b0fd12-d72d-4f66-a013-c1acdeea2670
Severity Medium
Tactics Privilege Escalation
Techniques T1484
Required Connectors AWS
Source View on GitHub

Tables Used

This content item queries data from the following tables:

Table Selection Criteria Transformations Ingestion API Lake-Only
AWSCloudTrail EventName == "ModifyDBCluster" ?

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · 📊

Back to Hunting Queries · Back to Amazon Web Services