Services or capabilities described in Amazon Web Services documentation might vary by Region. To see the differences applicable to the China Regions, see Getting Started with Amazon Web Services in China (PDF).

GuardDuty RDS Protection finding types

GuardDuty RDS Protection detects anomalous login behavior on your database instance. The following findings are specific to the Supported Amazon Aurora, Amazon RDS, and Aurora Limitless databases and will have a Resource Type of RDSDBInstance or RDSLimitlessDB. The severity and details of the findings will differ based on the finding type.

CredentialAccess:RDS/AnomalousBehavior.SuccessfulLogin

A user successfully logged into an RDS database in your account in an anomalous way.

Default severity: Variable

This finding informs you that an anomalous successful login was observed on an RDS database in your Amazon environment. This may indicate that a previous unseen user logged into an RDS database for the first time. A common scenario is an internal user logging into a database that is accessed programmatically by applications and not by individual users.

This successful login was identified as anomalous by the GuardDuty anomaly detection machine learning (ML) model. The ML model evaluates all database login events in your Supported Amazon Aurora, Amazon RDS, and Aurora Limitless databases and identifies anomalous events that are associated with techniques used by adversaries. The ML model tracks various factors of the RDS login activity such as the user that made the request, the location the request was made from, and the specific database connection details that were used. For information about the login events that are potentially unusual, see RDS login activity-based anomalies.

Remediation recommendations:

If this activity is unexpected for the associated database, it is recommended to change the password of the associated database user, and review available audit logs for activity performed by the anomalous user. Medium and high severity findings may indicate that there is an overly permissive access policy to the database, and user credentials may have been exposed or compromised. It is recommended to place the database in a private VPC, and limit the security group rules to allow traffic only from the necessary sources. For more information, see Remediating potentially compromised database with successful login events.

CredentialAccess:RDS/AnomalousBehavior.FailedLogin

One or more unusual failed login attempts were observed on an RDS database in your account.

Default severity: Low

This finding informs you that one or more anomalous failed logins were observed on an RDS database in your Amazon environment. A failed login attempts from public IP addresses may indicate that the RDS database in your account has been subject to an attempted brute force attack by a potentially malicious actor.

These failed logins were identified as anomalous by the GuardDuty anomaly detection machine learning (ML) model. The ML model evaluates all database login events in your Supported Amazon Aurora, Amazon RDS, and Aurora Limitless databases and identifies anomalous events that are associated with techniques used by adversaries. The ML model tracks various factors of the RDS login activity such as the user that made the request, the location the request was made from, and the specific database connection details that were used. For information about the RDS login activity that are potentially unusual, see RDS login activity-based anomalies.

Remediation recommendations:

If this activity is unexpected for the associated database, it may indicate that the database is publicly exposed or there is an overly permissive access policy to the database. It is recommended to place the database in a private VPC, and limit the security group rules to allow traffic only from the necessary sources. For more information, see Remediating potentially compromised database with failed login events.

CredentialAccess:RDS/AnomalousBehavior.SuccessfulBruteForce

A user successfully logged into an RDS database in your account from a public IP address in an anomalous way after a consistent pattern of unusual failed login attempts.

Default severity: High

This finding informs you that an anomalous login indicative of a successful brute force was observed on an RDS database in your Amazon environment. Prior to an anomalous successful login, a consistent pattern of unusual failed login attempts was observed. This indicates that the user and password associated with the RDS database in your account may have been compromised, and the RDS database may have been accessed by a potentially malicious actor.

This successful brute force login was identified as anomalous by the GuardDuty anomaly detection machine learning (ML) model. The ML model evaluates all database login events in your Supported Amazon Aurora, Amazon RDS, and Aurora Limitless databases and identifies anomalous events that are associated with techniques used by adversaries. The ML model tracks various factors of the RDS login activity such as the user that made the request, the location the request was made from, and the specific database connection details that were used. For information about the RDS login activity that are potentially unusual, see RDS login activity-based anomalies.

Remediation recommendations:

This activity indicates that database credentials may have been exposed or compromised. It is recommended to change the password of the associated database user, and review available audit logs for activity performed by the potentially compromised user. A consistent pattern of unusual failed login attempts indicate an overly permissive access policy to the database or the database may have also been public exposed. It is recommended to place the database in a private VPC, and limit the security group rules to allow traffic only from the necessary sources. For more information, see Remediating potentially compromised database with successful login events.

CredentialAccess:RDS/MaliciousIPCaller.SuccessfulLogin

A user successfully logged into an RDS database in your account from a known malicious IP address.

Default severity: High

This finding informs you that a successful RDS login activity occurred from an IP address that is associated with a known malicious activity in your Amazon environment. This indicates that the user and password associated with the RDS database in your account may have been compromised, and the RDS database may have been accessed by a potentially malicious actor.

Remediation recommendations:

If this activity is unexpected for the associated database, it may indicate that the user credentials may have been exposed or compromised. It is recommended to change the password of the associated database user, and review the available audit logs for activity performed by the compromised user. This activity may also indicate that there is an overly permissive access policy to the database or the database is publicly exposed. It is recommended to place the database in a private VPC, and limit the security group rules to allow traffic only from the necessary sources. For more information, see Remediating potentially compromised database with successful login events.

CredentialAccess:RDS/MaliciousIPCaller.FailedLogin

An IP address that is associated with a known malicious activity unsuccessfully attempted to log in to an RDS database in your account.

Default severity: Medium

This finding informs you that an IP address associated with known malicious activity attempted to log in to an RDS database in your Amazon environment, but failed to provide the correct user name or password. This indicates that a potentially malicious actor may be attempting to compromise the RDS database in your account.

Remediation recommendations:

If this activity is unexpected for the associated database, it may indicate that there is an overly permissive access policy to the database or the database is publicly exposed. It is recommended to place the database in a private VPC, and limit the security group rules to allow traffic only from the necessary sources. For more information, see Remediating potentially compromised database with failed login events.

Discovery:RDS/MaliciousIPCaller

An IP address that is associated with a known malicious activity probed an RDS database in your account; no authentication attempt was made.

Default severity: Medium

This finding informs you that an IP address associated with known a malicious activity probed an RDS database in your Amazon environment, though no login attempt was made. This may indicate that a potentially malicious actor is attempting to scan for a publicly accessible infrastructure.

Remediation recommendations:

If this activity is unexpected for the associated database, it may indicate that there is an overly permissive access policy to the database or the database is publicly exposed. It is recommended to place the database in a private VPC, and limit the security group rules to allow traffic only from the necessary sources. For more information, see Remediating potentially compromised database with failed login events.

CredentialAccess:RDS/TorIPCaller.SuccessfulLogin

A user successfully logged into an RDS database in your account from a Tor exit node IP address.

Default severity: High

This finding informs you that a user successfully logged in to an RDS database in your Amazon environment, from a Tor exit node IP address. Tor is a software for enabling anonymous communication. It encrypts and randomly bounces communications through relays between a series of network nodes. The last Tor node is called the exit node. This can indicate unauthorized access to the RDS resources in your account, with the intent of hiding the anonymous user's true identity.

Remediation recommendations:

If this activity is unexpected for the associated database, it may indicate that the user credentials may have been exposed or compromised. It is recommended to change the password of the associated database user, and review the available audit logs for activity performed by the compromised user. This activity may also indicate that there is an overly permissive access policy to the database or the database is publicly exposed. It is recommended to place the database in a private VPC, and limit the security group rules to allow traffic only from the necessary sources. For more information, see Remediating potentially compromised database with successful login events.

CredentialAccess:RDS/TorIPCaller.FailedLogin

A Tor IP address attempted to unsuccessfully log in to an RDS database in your account.

Default severity: Medium

This finding informs you that a Tor exit node IP address attempted to log in to an RDS database in your Amazon environment, but failed to provide the correct user name or password. Tor is a software for enabling anonymous communication. It encrypts and randomly bounces communications through relays between a series of network nodes. The last Tor node is called the exit node. This can indicate unauthorized access to the RDS resources in your account, with the intent of hiding the anonymous user's true identity.

Remediation recommendations:

If this activity is unexpected for the associated database, it may indicate that there is an overly permissive access policy to the database or the database is publicly exposed. It is recommended to place the database in a private VPC, and limit the security group rules to allow traffic only from the necessary sources. For more information, see Remediating potentially compromised database with failed login events.

Discovery:RDS/TorIPCaller

A Tor exit node IP address probed an RDS database in your account, no authentication attempt was made.

Default severity: Medium

This finding informs you that a Tor exit node IP address probed an RDS database in your Amazon environment, though no login attempt was made. This may indicate that a potentially malicious actor is attempting to scan for publicly accessible infrastructure. Tor is a software for enabling anonymous communication. It encrypts and randmonly bounces communications through relays between a series of network nodes. The last Tor node is called the exit node. This can indicate unauthorized access to the RDS resources in your account, with the intent of hiding the potentially malicious actor's true identity.

Remediation recommendations:

If this activity is unexpected for the associated database, it may indicate that there is an overly permissive access policy to the database or the database is publicly exposed. It is recommended to place the database in a private VPC, and limit the security group rules to allow traffic only from the necessary sources. For more information, see Remediating potentially compromised database with failed login events.

Exfiltration:RDS/AnomalousBehavior

Anomalous activity from a user extracting large volume of data from an RDS database in your account.

Default severity: Low

This finding informs you that anomalous database activity consistent with data exfiltration was observed on an RDS database in your Amazon environment. This may indicate that a database user selected a significantly higher number of rows than usual, or that the activity involved a previously unseen database attribute such as a new user, IP address, or database name that contributed to the volume spike. A common scenario is a compromised database credential being used to extract data through a combination of unusual access patterns and elevated query volume.

This activity was identified as anomalous by the GuardDuty anomaly detection machine learning (ML) model. The ML model evaluates all database activity events in your Supported Amazon Aurora, Amazon RDS, and Aurora Limitless databases and identifies anomalous events that are associated with techniques used by adversaries. The ML model tracks various factors of the RDS database activity such as the user that made the request, the queries executed, the volume of data accessed, and the specific database connection details that were used. For information about the database activity that is potentially unusual, see RDS data activity-based anomalies.

Remediation recommendations:

If this activity is unexpected for the associated database, it is recommended to change the password of the associated database user, and review available audit logs to determine what data the anomalous user accessed. It is recommended to place the database in a private VPC and limit the security group rules to allow traffic only from the necessary sources. For more information, see Remediating potentially compromised database with anomalous exfiltration activity.

Impact:RDS/AnomalousBehavior.Drop

Anomalous activity from a user dropping data from an RDS database in your account.

Default severity: Medium

This finding informs you that anomalous database activity consistent with destructive operations was observed on an RDS database in your Amazon environment. This may indicate that a database user dropped a significantly higher number of tables or database objects than usual, or that the activity involved a previously unseen database attribute such as a new user, IP address, or application name that contributed to the destructive operation. A common scenario is a compromised database credential being used to destroy database structures through a combination of unusual access patterns and elevated DROP statement volume.

This activity was identified as anomalous by the GuardDuty anomaly detection machine learning (ML) model. The ML model evaluates all database activity events in your Supported Amazon Aurora, Amazon RDS, and Aurora Limitless databases and identifies anomalous events that are associated with techniques used by adversaries. The ML model tracks various factors of the RDS database activity such as the user that made the request, the statements executed, the database objects targeted, and the specific database connection details that were used. For information about the database activity that is potentially unusual, see RDS data activity-based anomalies.

Remediation recommendations:

If this activity is unexpected for the associated database, it is recommended to immediately change the password of the associated database user and revoke their access. Review available audit logs to determine the scope of objects dropped, and initiate recovery from backups if necessary. It is also recommended to place the database in a private VPC and limit the security group rules to allow traffic only from the necessary sources. For more information, see Remediating potentially compromised database with anomalous destructive activity.

Impact:RDS/AnomalousBehavior.Delete

Anomalous activity from a user deleting data from an RDS database in your account.

Default severity: Low

This finding informs you that anomalous database activity consistent with destructive operations was observed on an RDS database in your Amazon environment. This may indicate that a database user deleted a significantly higher number of rows than usual, or that the activity involved a previously unseen database attribute, such as a new user, IP address, or application name, that contributed to the destructive operation. A common scenario is a compromised database credential being used to systematically remove data through a combination of unusual access patterns and elevated DELETE statement volume.

This activity was identified as anomalous by the GuardDuty anomaly detection machine learning (ML) model. The ML model evaluates all database activity events in your Supported Amazon Aurora, Amazon RDS, and Aurora Limitless databases and identifies anomalous events that are associated with techniques used by adversaries. The ML model tracks various factors of the RDS database activity such as the user that made the request, the statements executed, the number of rows affected, and the specific database connection details that were used. For information about the database activity that is potentially unusual, see RDS data activity-based anomalies.

Remediation recommendations:

If this activity is unexpected for the associated database, it is recommended to immediately change the password of the associated database user and revoke their access. Review available audit logs to determine the scope of data deleted, and initiate point-in-time recovery from automated backups if data loss is confirmed. It is also recommended to place the database in a private VPC and limit the security group rules to allow traffic only from the necessary sources. For more information, see Remediating potentially compromised database with anomalous destructive activity.

Exfiltration:RDS/MaliciousIPCaller

An IP address that is associated with known malicious activity executed data extraction queries on an RDS database in your account.

Default severity: High

This finding informs you that an IP address associated with known malicious activity executed database queries consistent with data exfiltration on an RDS database in your Amazon environment. This indicates that the user and password associated with the RDS database in your account may have been compromised, and the RDS database data may have been exfiltrated by a potentially malicious actor.

Remediation recommendations:

If this activity is unexpected for the associated database, it may indicate that the user credentials may have been exposed or compromised. It is recommended to change the password of the associated database user, and review available RDS data logs for activity performed by the compromised user. It is recommended to identify the data that was accessible to the affected user and assess the business impact of any potentially exfiltrated data. It is also recommended to place the database in a private VPC and limit the security group rules to allow traffic only from the necessary sources. For more information, see Remediating potentially compromised database with anomalous exfiltration activity.

Exfiltration:RDS/TorIPCaller

A Tor exit node IP address executed data extraction queries on an RDS database in your account.

Default severity: High

This finding informs you that a Tor exit node IP address executed database queries consistent with data exfiltration on an RDS database in your Amazon environment. Tor is a software for enabling anonymous communication. It encrypts and randomly bounces communications through relays between a series of network nodes. The last Tor node is called the exit node. This can indicate unauthorized access to the RDS resources in your account, with the intent of hiding the anonymous user's true identity while exfiltrating data.

Remediation recommendations:

If this activity is unexpected for the associated database, it may indicate that the user credentials may have been exposed or compromised. It is recommended to change the password of the associated database user, and review available RDS data logs for activity performed by the compromised user. It is recommended to identify the data that was accessible to the affected user and assess the business impact of any potentially exfiltrated data. It is also recommended to place the database in a private VPC and limit the security group rules to allow traffic only from the necessary sources. For more information, see Remediating potentially compromised database with anomalous exfiltration activity.

Impact:RDS/MaliciousIPCaller

An IP address that is associated with known malicious activity executed destructive statements on an RDS database in your account.

Default severity: High

This finding informs you that an IP address associated with known malicious activity executed database statements with destructive impact on an RDS database in your Amazon environment. This indicates that the user and password associated with the RDS database in your account may have been compromised, and the RDS database may have been subjected to destructive operations by a potentially malicious actor.

Remediation recommendations:

If this activity is unexpected for the associated database, it may indicate that the user credentials may have been exposed or compromised. It is recommended to immediately change the password of the associated database user and revoke their access. Review available RDS data logs to determine the scope of destructive operations performed, and initiate recovery from backups if necessary. It is also recommended to place the database in a private VPC and limit the security group rules to allow traffic only from the necessary sources. For more information, see Remediating potentially compromised database with anomalous destructive activity.

Impact:RDS/TorIPCaller

A Tor exit node IP address executed destructive statements on an RDS database in your account.

Default severity: High

This finding informs you that a Tor exit node IP address executed database statements with destructive impact on an RDS database in your Amazon environment. Tor is an overlay network for enabling anonymous communication. It encrypts and randomly bounces communications through relays between a series of network nodes. The last Tor node is called the exit node. This can indicate unauthorized access to the RDS resources in your account, with the intent of hiding the anonymous user's true identity while performing destructive operations.

Remediation recommendations:

If this activity is unexpected for the associated database, it may indicate that the user credentials may have been exposed or compromised. It is recommended to immediately change the password of the associated database user and revoke their access. Review available RDS data logs to determine the scope of destructive operations performed, and initiate recovery from backups if necessary. It is also recommended to place the database in a private VPC and limit the security group rules to allow traffic only from the necessary sources. For more information, see Remediating potentially compromised database with anomalous destructive activity.