First-Time Destructive MongoDB Command from a Client IP

  1[metadata]
  2creation_date = "2026/07/30"
  3integration = ["network_traffic"]
  4maturity = "production"
  5updated_date = "2026/07/30"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10Identifies the first client IP observed issuing MongoDB commands that can drop databases, collections, indexes, users,
 11or roles within a five-day history window. Adversaries with access to an exposed or compromised MongoDB service may use
 12these commands to destroy data, disrupt applications, or prepare a wipe-and-extort attack.
 13"""
 14false_positives = [
 15    """
 16    Database administrators, deployment automation, test teardown jobs, and schema migration tools may issue destructive
 17    commands legitimately. Validate the client address, target resource, change window, and associated administrator
 18    activity before escalating.
 19    """,
 20]
 21from = "now-9m"
 22index = ["logs-network_traffic.mongodb-*"]
 23language = "kuery"
 24license = "Elastic License v2"
 25name = "First-Time Destructive MongoDB Command from a Client IP"
 26note = """## Triage and analysis
 27
 28### Investigating First-Time Destructive MongoDB Command from a Client IP
 29
 30MongoDB wipe-and-extort campaigns commonly enumerate databases before dropping databases or collections and inserting a ransom note. This rule detects the first client IP observed issuing decoded MongoDB commands capable of destructive schema, data, identity, or access changes within a five-day history window.
 31
 32### Possible investigation steps
 33
 34- Review `client.ip`, `server.ip`, `network.community_id`, `network_traffic.mongodb.method`, `network_traffic.mongodb.query`, `network_traffic.mongodb.resource`, and `network_traffic.mongodb.fullCollectionName`.
 35- Determine whether the client is an approved application, DBA workstation, migration host, or automation service.
 36- Search earlier events on the same `network.community_id` for `listDatabases`, `listCollections`, `usersInfo`, or `rolesInfo`, which may indicate reconnaissance before destruction.
 37- Search subsequent activity for database or collection creation and ransom-related strings such as `README`, `RECOVER`, `bitcoin`, or `meow`.
 38- Confirm the operation and affected resources in MongoDB audit logs and assess whether data was deleted.
 39
 40### False positive analysis
 41
 42- Schema migrations and test cleanup can legitimately drop collections or indexes.
 43- Authorized identity lifecycle operations can drop users or roles.
 44- Scope exceptions to approved clients and maintenance windows rather than excluding command names globally.
 45
 46### Response and remediation
 47
 48- Block the client and isolate the MongoDB service if the activity is unauthorized.
 49- Preserve MongoDB audit logs and packet evidence, identify affected databases, and begin recovery from immutable backups.
 50- Rotate database credentials, remove unauthorized users or roles, and restrict MongoDB network access to approved application and administration hosts.
 51"""
 52references = [
 53    "https://www.bleepingcomputer.com/news/security/mongo-lock-attack-ransoming-deleted-mongodb-databases/",
 54    "https://flare.io/learn/resources/blog/mongodb-ransom",
 55    "https://attack.mitre.org/techniques/T1485/",
 56]
 57risk_score = 73
 58rule_id = "0d8a33be-5595-400c-a677-c4474829ed55"
 59setup = """## Setup
 60
 61This rule requires the Elastic Network Packet Capture integration with the MongoDB protocol analyzer enabled and
 62cleartext visibility into MongoDB transactions. TLS-encrypted or compressed MongoDB wire traffic may not expose
 63`network_traffic.mongodb.query`. Modern OP_MSG traffic often reports `network_traffic.mongodb.method` as `msg`, so the
 64query-text branch is required. Use MongoDB audit logs for authoritative user attribution and operation outcomes.
 65"""
 66severity = "high"
 67tags = [
 68    "Domain: Network",
 69    "Use Case: Network Security Monitoring",
 70    "Use Case: Threat Detection",
 71    "Tactic: Impact",
 72    "Data Source: Network Packet Capture",
 73    "Resources: Investigation Guide",
 74]
 75timestamp_override = "event.ingested"
 76type = "new_terms"
 77
 78query = '''
 79data_stream.dataset:network_traffic.mongodb and
 80(
 81  network_traffic.mongodb.method:(
 82    "dropDatabase" or "drop" or "dropIndexes" or
 83    "dropAllUsersFromDatabase" or "dropAllRolesFromDatabase"
 84  ) or
 85  (
 86    network_traffic.mongodb.method:"msg" and
 87    network_traffic.mongodb.query:(
 88      *dropDatabase* or *dropIndexes* or
 89      *dropAllUsersFromDatabase* or *dropAllRolesFromDatabase* or
 90      *\"drop\"*
 91    )
 92  )
 93)
 94'''
 95
 96
 97[[rule.threat]]
 98framework = "MITRE ATT&CK"
 99[[rule.threat.technique]]
100id = "T1485"
101name = "Data Destruction"
102reference = "https://attack.mitre.org/techniques/T1485/"
103
104
105[rule.threat.tactic]
106id = "TA0040"
107name = "Impact"
108reference = "https://attack.mitre.org/tactics/TA0040/"
109
110[rule.new_terms]
111field = "new_terms_fields"
112value = ["client.ip"]
113
114[[rule.new_terms.history_window_start]]
115field = "history_window_start"
116value = "now-5d"```