LoFP / database administrators, deployment automation, test teardown jobs, and schema migration tools may issue destructive commands legitimately. validate the client address, target resource, change window, and associated administrator activity before escalating.

Techniques

• T1485

Sample rules

First-Time Destructive MongoDB Command from a Client IP

• source: elastic
• technicques:
  • T1485

Description

Identifies the first client IP observed issuing MongoDB commands that can drop databases, collections, indexes, users, or roles within a five-day history window. Adversaries with access to an exposed or compromised MongoDB service may use these commands to destroy data, disrupt applications, or prepare a wipe-and-extort attack.

Detection logic

data_stream.dataset:network_traffic.mongodb and
(
  network_traffic.mongodb.method:(
    "dropDatabase" or "drop" or "dropIndexes" or
    "dropAllUsersFromDatabase" or "dropAllRolesFromDatabase"
  ) or
  (
    network_traffic.mongodb.method:"msg" and
    network_traffic.mongodb.query:(
      *dropDatabase* or *dropIndexes* or
      *dropAllUsersFromDatabase* or *dropAllRolesFromDatabase* or
      *\"drop\"*
    )
  )
)