ISIT Security LabsIncident response training

MeridianOps Cloud · Production MySQL on Amazon RDS

RDS Brute Force Attack Investigation

Intermediate25 minCloud Security / Database Security / Incident Response
Now: Case briefing. Read the ticket and environment first. Do not open logs until you know what you are looking for.

Ticket summary

On 19 August 2026 MeridianOps Cloud security monitoring detected an unusual increase in failed authentication attempts against a production RDS database. Application traffic still looks broadly normal, but repeated failures from an external source have raised concern. You are the investigating SOC analyst.

MeridianOps Cloud runs customer-facing workloads in AWS account 851725491209 (ap-south-1). Production relational data is hosted on Amazon RDS. The database team reports that core application traffic appears healthy, but monitoring has flagged repeated authentication failures against a production MySQL instance.

GuardDuty has raised a HIGH finding for anomalous RDS login activity. The investigation package includes RDS authentication logs, database query activity, instance metadata, CloudWatch-style metrics, CloudTrail RDS API noise, and the GuardDuty finding.

Determine whether this is a brute-force attack, identify the targeted instance and database account, establish whether authentication succeeded, assess post-login activity, and recommend containment. Do not assume every failed login in the window is malicious.