Detection catalogue

Explore published rules with transparent provenance, licensing, and ATT&CK mappings.

detections

Loading detections…

AWS RDS DB Snapshot Shared with Another Account

Identifies when an AWS RDS DB snapshot is shared with another AWS account or made public. DB snapshots contain complete backups of database instances, including schemas, table data, and sensitive application content. When shared externally, snapshots can be restored in another AWS environment, enabling unauthorized access, offline analysis, or data exfiltration. Adversaries who obtain valid credentials or exploit misconfigurations may modify snapshot attributes to grant access to accounts they control, bypassing network, IAM, and monitoring controls.

ATT&CK coverage

Outside the enterprise matrix

T1537Transfer Data to Cloud Account 41 detections cover this technique

Detection requirements

Log source category: event_index

What the source says

What fires this without an attack behind it

Cross-account DB snapshot sharing is common in multi-account AWS Organizations, particularly for backup workflows, migrations, analytics pipelines, and disaster recovery. Ensure the added account is expected, previously approved, and aligns with operational change plans before taking action.

References

Tagged by the source as

Data Source: Amazon Web ServicesData Source: AWSData Source: AWS RDSDomain: CloudResources: Investigation GuideTactic: ExfiltrationUse Case: Threat Detection

Detection logic

Published to signed-in readers

The query as its source wrote it, its canonical form, and the content hash that pins this exact revision.