Elastic high stable kql

First-Time Destructive MongoDB Command from a Client IP

Identifies the first client IP observed issuing MongoDB commands that can drop databases, collections, indexes, users, or roles within a five-day history window. Adversaries with access to an exposed or compromised MongoDB service may use these commands to destroy data, disrupt applications, or prepare a wipe-and-extort attack.

View Source

Detection Logic

data_stream.dataset:network_traffic.mongodb and
(
  network_traffic.mongodb.method:(
    "dropDatabase" or "drop" or "dropIndexes" or
    "dropAllUsersFromDatabase" or "dropAllRolesFromDatabase"
  ) or
  (
    network_traffic.mongodb.method:"msg" and
    network_traffic.mongodb.query:(
      *dropDatabase* or *dropIndexes* or
      *dropAllUsersFromDatabase* or *dropAllRolesFromDatabase* or
      *\"drop\"*
    )
  )
)

False Positives

⚠ Database administrators, deployment automation, test teardown jobs, and schema migration tools may issue destructive commands legitimately. Validate the client address, target resource, change window, and associated administrator activity before escalating.

Field Validations

Loading…

Comments (0)

Loading comments...