PostgreSQL COPY PROGRAM Command Execution

 1[metadata]
 2creation_date = "2026/07/30"
 3integration = ["network_traffic"]
 4maturity = "production"
 5updated_date = "2026/07/30"
 6
 7[rule]
 8author = ["Elastic"]
 9description = """
10Identifies PostgreSQL "COPY" statements that invoke an operating-system command through the "PROGRAM" option. A
11superuser or role with "pg_execute_server_program" can use this feature to execute arbitrary commands as the PostgreSQL
12service account, a technique used after credential compromise and by cryptomining campaigns.
13"""
14false_positives = [
15    """
16    Database administrators and scheduled data-processing jobs may legitimately use COPY PROGRAM for import or export
17    workflows. Confirm the command, client address, database role, maintenance context, and resulting process activity
18    before escalating.
19    """,
20]
21from = "now-9m"
22index = ["logs-network_traffic.pgsql-*"]
23language = "eql"
24license = "Elastic License v2"
25name = "PostgreSQL COPY PROGRAM Command Execution"
26note = """## Triage and analysis
27
28### Investigating PostgreSQL COPY PROGRAM Command Execution
29
30PostgreSQL supports `COPY ... FROM PROGRAM` and `COPY ... TO PROGRAM` for server-side process execution. Attackers who obtain a privileged database identity can use this feature to launch shells, download payloads, establish persistence, or deploy cryptominers from the PostgreSQL process context.
31
32### Possible investigation steps
33
34- Review `client.ip`, `server.ip`, `network.community_id`, `network_traffic.pgsql.query`, and PostgreSQL error fields.
35- Extract the command passed to `PROGRAM` and identify referenced shells, interpreters, downloaders, files, or network destinations.
36- Confirm the database role and whether it has superuser or `pg_execute_server_program` privileges using PostgreSQL audit and server logs.
37- Correlate the event with endpoint telemetry for `postgres` spawning `sh`, `bash`, `curl`, `wget`, `python`, `perl`, `nc`, miners, or other unusual child processes.
38- Search earlier events from the client for authentication failures, role changes, extension creation, or database enumeration.
39
40### False positive analysis
41
42- Approved ETL, backup, and administrative automation can use COPY PROGRAM.
43- Scope exceptions to a documented client, command family, and maintenance context; do not globally exclude the `PROGRAM` keyword.
44
45### Response and remediation
46
47- Terminate the database session and isolate the server if unauthorized process execution is confirmed.
48- Preserve PostgreSQL, endpoint, and network evidence and remove malicious processes or persistence.
49- Rotate affected credentials and revoke unnecessary superuser and `pg_execute_server_program` privileges.
50"""
51references = [
52    "https://www.postgresql.org/docs/current/sql-copy.html",
53    "https://www.aquasec.com/blog/pg_mem-a-malware-hidden-in-the-postgres-processes/",
54    "https://www.wiz.io/blog/postgresql-cryptomining",
55    "https://attack.mitre.org/techniques/T1059/",
56]
57risk_score = 73
58rule_id = "8ab64631-17ee-46b9-9800-9acacbeee1b3"
59setup = """## Setup
60
61This rule requires the Elastic Network Packet Capture integration with the PostgreSQL protocol analyzer enabled and
62cleartext visibility into PostgreSQL query traffic. TLS-encrypted sessions, prepared statements, packet loss, and
63asymmetric capture can hide or fragment query text. Use PostgreSQL audit logs and endpoint process telemetry to confirm
64the database identity and command execution outcome.
65"""
66severity = "high"
67tags = [
68    "Domain: Network",
69    "Use Case: Network Security Monitoring",
70    "Use Case: Threat Detection",
71    "Tactic: Execution",
72    "Data Source: Network Packet Capture",
73    "Resources: Investigation Guide",
74]
75timestamp_override = "event.ingested"
76type = "eql"
77
78query = '''
79any where data_stream.dataset == "network_traffic.pgsql" and
80    (
81        network_traffic.pgsql.query like~ "*copy*from*program*" or
82        network_traffic.pgsql.query like~ "*copy*to*program*"
83    )
84'''
85
86
87[[rule.threat]]
88framework = "MITRE ATT&CK"
89[[rule.threat.technique]]
90id = "T1059"
91name = "Command and Scripting Interpreter"
92reference = "https://attack.mitre.org/techniques/T1059/"
93
94
95[rule.threat.tactic]
96id = "TA0002"
97name = "Execution"
98reference = "https://attack.mitre.org/tactics/TA0002/"