Analytics BIOC
Low
✕
An RDS snapshot was exported to an unknown S3 bucket
An RDS snapshot was exported to an S3 bucket. The destination S3 bucket was not seen in your organization in the last 30 days.
- Module:
- Cortex Cloud
- Licensed by:
- Cloud Runtime Security (CRS)
- Data source:
- AWS Audit Log
ATT&CK tactics: Exfiltration (TA0010)
ATT&CK techniques: Transfer Data to Cloud Account (T1537)
Detector tags: Data Detection & Response
Attacker's goals:
Exfiltrate data to an unknown bucket.
Investigative actions:
Check the legitimacy of the referenced destination bucket. Review further logs for the source snapshot ID. Review further actions performed by the identity and role.
- Test period:
- N/A (single event)
- Deduplication:
- 1 Day
3 variations:
- An RDS snapshot was exported to an unknown S3 bucket by an admin identity Informational (parent: Low)
- An RDS snapshot was exported to an unknown S3 bucket with suspicious indicators Medium (parent: Low)
- An RDS snapshot was exported to an unknown S3 bucket - denied attempt Informational (parent: Low)