Restore Public AWS RDS Instance (c3f265c7-ff03-4056-8ab2-d486227b4599)
Detects the recovery of a new public database instance from a snapshot. It may be a part of data exfiltration.
| Cluster A | Galaxy A | Cluster B | Galaxy B | Level |
|---|---|---|---|---|
| Automated Exfiltration - T1020 (774a3188-6ba9-4dc4-879d-d54ee48a5ce9) | Attack Pattern | Restore Public AWS RDS Instance (c3f265c7-ff03-4056-8ab2-d486227b4599) | Sigma-Rules | 1 |