Analytics BIOC Informational
✕

Unusual DB process spawning a shell

A DB related process abnormally spawned a shell. This might indicate an exploitation attempt.

Module:
Platform Analytics
Data source:
XDR Agent
ATT&CK tactics: Initial Access (TA0001) Lateral Movement (TA0008)
ATT&CK techniques: Exploit Public-Facing Application (T1190) Exploitation of Remote Services (T1210)
Detector tags: Shell Analytics
Attacker's goals:

Obtain access to either the database or its hosting machine for various purposes like privilege escalation, lateral movement, and data theft.

Investigative actions:

Review the commands/processes executed by the shell for malicious actions. Check if and what else the DB process has executed. Check for any additional alerts raised in the context of the DB process. Audit the query/access logs of the DB for suspicious actions (Such as SQL injection or similar).

Test period:
N/A (single event)
Deduplication:
1 Day
3 variations:
  • Unusual DB process spawning a shell with a possible reconnaissance command Low (parent: Informational)
  • Unusual DB process spawning a shell with a possible web download/access command Low (parent: Informational)
  • Unusual DB process spawning a shell with an unusual command line Low (parent: Informational)