Elastic high stable eql

PostgreSQL COPY PROGRAM Command Execution

Identifies PostgreSQL "COPY" statements that invoke an operating-system command through the "PROGRAM" option. A superuser or role with "pg_execute_server_program" can use this feature to execute arbitrary commands as the PostgreSQL service account, a technique used after credential compromise and by cryptomining campaigns.

View Source

Detection Logic

any where data_stream.dataset == "network_traffic.pgsql" and
    (
        network_traffic.pgsql.query like~ "*copy*from*program*" or
        network_traffic.pgsql.query like~ "*copy*to*program*"
    )

False Positives

⚠ Database administrators and scheduled data-processing jobs may legitimately use COPY PROGRAM for import or export workflows. Confirm the command, client address, database role, maintenance context, and resulting process activity before escalating.

Field Validations

Loading…

Comments (0)

Loading comments...