Restore Public AWS RDS Instance — Detection Rule

Detects the recovery of a new public database instance from a snapshot. It may be a part of data exfiltration.

Read the full analysis on IntelFusions