AWS RDS Deletion Protection Disabled

Description

Detects when deletion protection is disabled on an RDS instance or cluster. This is often a precursor to database deletion and may indicate ransomware or data destruction attacks where attackers first disable protections before deleting resources.

Query · python

from panther_aws_helpers import aws_rds_context


def rule(event):
    if event.get("eventSource") != "rds.amazonaws.com":
        return False
    modify_events = ["ModifyDBInstance", "ModifyDBCluster"]
    if event.get("eventName") not in modify_events:
        return False
    if event.deep_get("errorCode") is not None:
        return False
    deletion_protection = event.deep_get("requestParameters", "deletionProtection", default=None)
    if deletion_protection is False:
        return True
    return False


def title(event):
    event_name = event.get("eventName", "Unknown")
    db_identifier = event.deep_get("requestParameters", "dBInstanceIdentifier") or event.deep_get(
        "requestParameters", "dBClusterIdentifier", default="<UNKNOWN>"
    )
    user = event.deep_get("userIdentity", "userName") or event.deep_get(
        "userIdentity", "principalId", default="<UNKNOWN_USER>"
    )
    resource_type = "Instance" if event_name == "ModifyDBInstance" else "Cluster"
    return f"RDS {resource_type} Deletion Protection Disabled: [{db_identifier}] by [{user}]"


def dedup(event):
    db_identifier = event.deep_get("requestParameters", "dBInstanceIdentifier") or event.deep_get(
        "requestParameters", "dBClusterIdentifier", default="unknown"
    )
    account_id = event.deep_get("recipientAccountId", default="unknown")
    region = event.get("awsRegion", "unknown")
    return f"{account_id}:{region}:{db_identifier}"


def alert_context(event):
    context = aws_rds_context(event)
    context["deletion_protection"] = event.deep_get(
        "requestParameters", "deletionProtection", default="N/A"
    )
    context["apply_immediately"] = event.deep_get(
        "requestParameters", "applyImmediately", default="N/A"
    )
    backup_retention = event.deep_get("requestParameters", "backupRetentionPeriod", default=None)
    if backup_retention is not None:
        context["backup_retention_period"] = backup_retention
    publicly_accessible = event.deep_get("requestParameters", "publiclyAccessible", default=None)
    if publicly_accessible is not None:
        context["publicly_accessible_changed"] = publicly_accessible
    return context

Analyst notes

Find all RDS modification events by the user ARN in the 24 hours before the alert
Check if this user has disabled deletion protection in the past 90 days to determine if this is normal behavior
Look for database deletion attempts from this user in the 2 hours after this modification
Immediately re-enable deletion protection if unauthorized using ModifyDBInstance or ModifyDBCluster with deletionProtection:true

Detection tier

Atomic IOCs
Network & Host Artifacts
Tools
TTPs
Pending classification

Metadata

Source: panther-labs/panther-analysis
License: Apache 2.0
Severity: High
Status: Stable
Query type: python
Created: 2026-04-20
Modified: 2026-05-05
Authored by: panther-labs
Source ID
Upstream: rules/aws_cloudtrail_rules/aws_rds_deletion_protection_disabled.yml
Type: rule
Version: 2
References: https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_DeleteInstance.html
Data sources: AWS.CloudTrail

ATT&CK

TA0005TA0040 T1490 T1562