Public AWS RDS Instance Restored From Snapshot

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•31

This rule detects when an AWS RDS database instance is restored from a snapshot and configured to be publicly accessible. This activity could indicate an attempt to exfiltrate data by making a copy of a database publicly available.