database administrators and scheduled data-processing jobs may legitimately use copy program for import or export workflows. confirm the command, client address, database role, maintenance context, and resulting process activity before escalating.

t1059
network
elastic

Techniques

T1059

Sample rules

PostgreSQL COPY PROGRAM Command Execution

source: elastic
technicques:
- T1059

Description

Identifies PostgreSQL “COPY” statements that invoke an operating-system command through the “PROGRAM” option. A superuser or role with “pg_execute_server_program” can use this feature to execute arbitrary commands as the PostgreSQL service account, a technique used after credential compromise and by cryptomining campaigns.

Detection logic

any where data_stream.dataset == "network_traffic.pgsql" and
    (
        network_traffic.pgsql.query like~ "*copy*from*program*" or
        network_traffic.pgsql.query like~ "*copy*to*program*"
    )