AWS RDS Automated Backup Deleted

Description

Detects deletion of RDS automated backups. This is a classic ransomware tactic where attackers delete automated backups before encrypting or destroying databases to prevent recovery. Any automated backup deletion should be investigated immediately.

Query · python

from panther_aws_helpers import aws_rule_context


def rule(event):
    if event.get("eventSource") != "rds.amazonaws.com":
        return False
    deletion_events = ["DeleteDBInstanceAutomatedBackup", "DeleteDBClusterAutomatedBackup"]
    if event.get("eventName") not in deletion_events:
        return False
    return event.deep_get("errorCode") is None


def title(event):
    event_name = event.get("eventName", "Unknown")
    backup_arn = event.deep_get("requestParameters", "dbiResourceId") or event.deep_get(
        "requestParameters", "dbClusterResourceId", default="<UNKNOWN>"
    )
    user = event.deep_get("userIdentity", "userName") or event.deep_get(
        "userIdentity", "principalId", default="<UNKNOWN_USER>"
    )
    resource_type = (
        "Automated Backup" if event_name == "DeleteDBInstanceAutomatedBackup" else "Cluster Backup"
    )
    return f"RDS {resource_type} Deleted: [{backup_arn}] by [{user}]"


def dedup(event):
    backup_id = event.deep_get("requestParameters", "dbiResourceId") or event.deep_get(
        "requestParameters", "dbClusterResourceId", default="unknown"
    )
    account_id = event.deep_get("recipientAccountId", default="unknown")
    region = event.get("awsRegion", "unknown")
    return f"{account_id}:{region}:{backup_id}"


def alert_context(event):
    context = aws_rule_context(event)
    context["dbi_resource_id"] = event.deep_get("requestParameters", "dbiResourceId", default="N/A")
    context["db_cluster_resource_id"] = event.deep_get(
        "requestParameters", "dbClusterResourceId", default="N/A"
    )
    context["backup_arn"] = event.deep_get(
        "responseElements", "dBInstanceAutomatedBackupArn"
    ) or event.deep_get("responseElements", "dBClusterAutomatedBackupArn", default="N/A")
    return context

Analyst notes

Find all automated backup deletion events by the user ARN in the past 24 hours to identify bulk deletion patterns
Check if this user has deleted automated backups in the past 90 days to determine if this is normal behavior
Look for database deletion or modification events from this user in the 6 hours after this backup deletion

Detection tier

Atomic IOCs
Network & Host Artifacts
Tools
TTPs
Pending classification

Metadata

Source: panther-labs/panther-analysis
License: Apache 2.0
Severity: Critical
Status: Stable
Query type: python
Created: 2026-04-20
Modified: 2026-05-05
Authored by: panther-labs
Source ID
Upstream: rules/aws_cloudtrail_rules/aws_rds_automated_backup_deleted.yml
Type: rule
Version: 2
References: https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_WorkingWithAutomatedBackups.html
Data sources: AWS.CloudTrail

ATT&CK

TA0040 T1485 T1490