Modify or Delete AWS RDS Cluster

[saakovv]

Summary of the Pull Request

Detects modifications to an RDS cluster or the deletion of an RDS cluster. These actions could be part of a data exfiltration attempt or unauthorized exposure of sensitive data.

Changelog

Example Log Event

{ [-]
   awsCloud_account_ID: 123
    awsRegion: sa-east
   cwlGroupname: aws-controltower/CloudTrailLogs
   eventCategory: Management
   eventID: 123
   eventName: ModifyDBCluster
   eventSource: rds.amazonaws.com
   eventTime: 2024-09-18T15:29:09Z
   eventType: AwsApiCall
   eventVersion: 1.08
   managementEvent: true
   readOnly: false
   recipientAccountId: 123
   requestID: 123
   requestParameters: { [+]
   }
   responseElements: { [+]
   }
   sourceIPAddress: XXX
   tlsDetails: { [+]
   }
   userAgent: APN/1.0 HashiCorp/
   userIdentity: { [+]
   }
}

{ [-]
   awsCloud_account_ID: 123
    awsRegion: sa-east
   cwlGroupname: aws-controltower/CloudTrailLogs
   eventCategory: Management
   eventID: 123
   eventName: DeleteDBCluster
   eventSource: rds.amazonaws.com
   eventTime: 2024-09-18T15:39:09Z
   eventType: AwsApiCall
   eventVersion: 1.08
   managementEvent: true
   readOnly: false
   recipientAccountId: 123
   requestID: 123
   requestParameters: { [+]
   }
   responseElements: { [+]
   }
   sourceIPAddress: XXX
   tlsDetails: { [+]
   }
   userAgent: APN/1.0 HashiCorp/
   userIdentity: { [+]
   }
}

Fixed Issues

SigmaHQ Rule Creation Conventions

• If your PR adds new rules, please consider following and applying these conventions