legitimate postgresql recovery operations performed by splunk administrators through the backup and restore api. these should be rare and originate from known management networks. if such operations occur in your environment, scope exceptions by source ip or approved management network rather than suppressing the rule entirely.

Techniques

T1190

Sample rules

Splunk Enterprise PostgreSQL Backup-to-Restore Potential RCE Sequence

source: elastic
technicques:
- T1190

Description

Detects a POST to the Splunk Enterprise PostgreSQL backup endpoint followed by a POST to the restore endpoint from the same client to the same host within a 15-minute window. This sequence is unusual and can align with the public CVE-2026-20253 pre-authentication RCE chain, where an attacker stages a database dump via the backup path and executes attacker-controlled SQL via the restore path.

Detection logic

from logs-network_traffic.http*, logs-zeek.http*, logs-suricata.eve*
| where http.request.method == "POST"
  and (
    url.path like "*splunkd/__raw/v1/postgres/recovery/*" or
    url.path like "/v1/postgres/recovery/*"
  )
| eval Esql.is_backup = case(url.path like "*/backup", 1, 0)
| eval Esql.is_restore = case(url.path like "*/restore", 1, 0)
| stats
    Esql.backup_count = SUM(Esql.is_backup),
    Esql.restore_count = SUM(Esql.is_restore),
    Esql.first_seen = MIN(@timestamp),
    Esql.last_seen = MAX(@timestamp),
    Esql.statuses = VALUES(http.response.status_code)
  by source.ip, destination.ip
| eval Esql.duration_minutes = DATE_DIFF("minute", Esql.first_seen, Esql.last_seen)
| where Esql.backup_count >= 1 and Esql.restore_count >= 1
  and Esql.duration_minutes <= 15
| keep source.ip, destination.ip, Esql.*