First Time Seen Memcached Writer

  1[metadata]
  2creation_date = "2026/07/30"
  3integration = ["network_traffic"]
  4maturity = "production"
  5updated_date = "2026/07/30"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10Identifies the first successful or no-reply Memcached store command from a client to a server. Memcached commonly has no
 11authentication, so an unauthorized writer can overwrite session tokens, poison cached application content, or alter
 12security-sensitive state. This behavior can enable session hijacking such as the exposure described by CVE-2026-29093.
 13"""
 14false_positives = [
 15    """
 16    New application servers, autoscaled workloads, cache warmers, deployment jobs, administrative tools, and failover
 17    systems may legitimately write to Memcached for the first time. Validate the client and server roles, affected keys,
 18    deployment context, and application behavior before escalating.
 19    """,
 20]
 21from = "now-9m"
 22index = ["logs-network_traffic.memcached-*"]
 23language = "kuery"
 24license = "Elastic License v2"
 25name = "First Time Seen Memcached Writer"
 26note = """## Triage and analysis
 27
 28### Investigating First Time Seen Memcached Writer
 29
 30Memcached permits store commands without authentication by default. A client with network access can use `set`, `add`, `replace`, `append`, `prepend`, or `cas` to overwrite session objects or inject content consumed by an application. This rule uses a seven-day new-terms history window to surface the first observed client, Memcached server, and store command combination performing a successful operation or issuing a store command with `noreply`.
 31
 32The rule does not inspect cached values and does not prove that a session was hijacked. It identifies an unusual writer relationship that requires application and asset context.
 33
 34### Possible investigation steps
 35
 36- Review `client.ip`, `server.ip`, `server.port`, `network.community_id`, `network_traffic.memcached.request.command`, `network_traffic.memcached.request.keys`, `network_traffic.memcached.response.type`, and `network_traffic.memcached.response.status_code`.
 37- Determine whether the client is an approved application server, cache warmer, administrative host, deployment job, or newly scaled workload.
 38- Inspect key names for application-specific session prefixes such as `memc.sess.key`, `PHPSESSID`, or `session`. Do not retrieve or ingest cached values unless incident response requires it and access controls permit it.
 39- Search earlier Memcached events from the same client for `get`, `gets`, `stats`, `lru_crawler`, or key enumeration activity that could indicate discovery before modification.
 40- Search subsequent events for `flush_all`, delete bursts, privileged web sessions from new source addresses or user agents, and administrative actions without the normal authentication sequence.
 41- Review application and identity logs to determine whether the write was followed by session reuse or impersonation.
 42
 43### False positive analysis
 44
 45- Autoscaling and deployments can introduce legitimate first-time writers.
 46- NAT or proxies can combine multiple application instances under one client address or make a known writer appear new.
 47- Add exceptions for validated client and server pairs rather than excluding store commands globally.
 48
 49### Response and remediation
 50
 51- Block unauthorized clients and restrict Memcached listeners to approved application and administration networks.
 52- Invalidate affected sessions and rotate exposed credentials if session manipulation is suspected.
 53- Bind Memcached to private interfaces, enforce network-layer access controls, and disable UDP unless explicitly needed.
 54"""
 55references = [
 56    "https://nvd.nist.gov/vuln/detail/CVE-2026-29093",
 57    "https://attack.mitre.org/techniques/T1565/001/",
 58    "https://www.elastic.co/docs/reference/integrations/network_traffic",
 59]
 60risk_score = 47
 61rule_id = "63c3c736-72e1-4d41-8022-27b5c4935e93"
 62setup = """## Setup
 63
 64This rule requires the Elastic Network Packet Capture integration with the Memcached protocol analyzer enabled and
 65cleartext visibility into client-to-server transactions. The sensor must observe responses to confirm successful
 66operations, except when the client explicitly uses `noreply`.
 67
 68Keep value capture disabled unless it is explicitly required and protected. Cached values can contain live session
 69tokens, credentials, personal data, and other sensitive application content. Key and command metadata are sufficient
 70for this rule.
 71"""
 72severity = "medium"
 73tags = [
 74    "Domain: Network",
 75    "Use Case: Network Security Monitoring",
 76    "Use Case: Threat Detection",
 77    "Tactic: Impact",
 78    "Data Source: Network Packet Capture",
 79    "Resources: Investigation Guide",
 80]
 81timestamp_override = "event.ingested"
 82type = "new_terms"
 83
 84query = '''
 85data_stream.dataset:network_traffic.memcached and
 86client.ip:* and server.ip:* and
 87network_traffic.memcached.request.command:("set" or "add" or "replace" or "append" or "prepend" or "cas") and
 88(
 89  network_traffic.memcached.response.type:("Success" or "success") or
 90  network_traffic.memcached.response.status_code:0 or
 91  network_traffic.memcached.request.noreply:true
 92)
 93'''
 94
 95
 96[[rule.threat]]
 97framework = "MITRE ATT&CK"
 98[[rule.threat.technique]]
 99id = "T1565"
100name = "Data Manipulation"
101reference = "https://attack.mitre.org/techniques/T1565/"
102[[rule.threat.technique.subtechnique]]
103id = "T1565.001"
104name = "Stored Data Manipulation"
105reference = "https://attack.mitre.org/techniques/T1565/001/"
106
107
108
109[rule.threat.tactic]
110id = "TA0040"
111name = "Impact"
112reference = "https://attack.mitre.org/tactics/TA0040/"
113
114[rule.investigation_fields]
115field_names = [
116    "@timestamp",
117    "client.ip",
118    "server.ip",
119    "server.port",
120    "network.community_id",
121    "network_traffic.memcached.protocol_type",
122    "network_traffic.memcached.request.command",
123    "network_traffic.memcached.request.keys",
124    "network_traffic.memcached.request.noreply",
125    "network_traffic.memcached.response.type",
126    "network_traffic.memcached.response.status_code",
127]
128
129[rule.new_terms]
130field = "new_terms_fields"
131value = ["client.ip", "server.ip", "network_traffic.memcached.request.command"]
132[[rule.new_terms.history_window_start]]
133field = "history_window_start"
134value = "now-7d"