new application servers, autoscaled workloads, cache warmers, deployment jobs, administrative tools, and failover systems may legitimately write to memcached for the first time. validate the client and server roles, affected keys, deployment context, and application behavior before escalating.

t1565
network
elastic

Techniques

T1565

Sample rules

First Time Seen Memcached Writer

source: elastic
technicques:
- T1565

Description

Identifies the first successful or no-reply Memcached store command from a client to a server. Memcached commonly has no authentication, so an unauthorized writer can overwrite session tokens, poison cached application content, or alter security-sensitive state. This behavior can enable session hijacking such as the exposure described by CVE-2026-29093.

Detection logic

data_stream.dataset:network_traffic.memcached and
client.ip:* and server.ip:* and
network_traffic.memcached.request.command:("set" or "add" or "replace" or "append" or "prepend" or "cas") and
(
  network_traffic.memcached.response.type:("Success" or "success") or
  network_traffic.memcached.response.status_code:0 or
  network_traffic.memcached.request.noreply:true
)