« Successful AMQP Multi-Queue Purge Burst First Time Seen Memcached Writer »
Elastic Docs ›Elastic Security [8.19] ›Downloadable rule update v8.19.29

First-Time Destructive MongoDB Command from a Client IP

edit
IMPORTANT: This documentation is no longer updated. Refer to Elastic's version policy and the latest documentation.

First-Time Destructive MongoDB Command from a Client IP

edit

Identifies the first client IP observed issuing MongoDB commands that can drop databases, collections, indexes, users, or roles within a five-day history window. Adversaries with access to an exposed or compromised MongoDB service may use these commands to destroy data, disrupt applications, or prepare a wipe-and-extort attack.

Rule type: new_terms

Rule indices:

  • logs-network_traffic.mongodb-*

Severity: high

Risk score: 73

Runs every: 5m

Searches indices from: now-9m (Date Math format, see also Additional look-back time)

Maximum alerts per execution: 100

References:

Tags:

  • Domain: Network
  • Use Case: Network Security Monitoring
  • Use Case: Threat Detection
  • Tactic: Impact
  • Data Source: Network Packet Capture
  • Resources: Investigation Guide

Version: 1

Rule authors:

  • Elastic

Rule license: Elastic License v2

Investigation guide

edit

Triage and analysis

Investigating First-Time Destructive MongoDB Command from a Client IP

MongoDB wipe-and-extort campaigns commonly enumerate databases before dropping databases or collections and inserting a ransom note. This rule detects the first client IP observed issuing decoded MongoDB commands capable of destructive schema, data, identity, or access changes within a five-day history window.

Possible investigation steps

  • Review client.ip, server.ip, network.community_id, network_traffic.mongodb.method, network_traffic.mongodb.query, network_traffic.mongodb.resource, and network_traffic.mongodb.fullCollectionName.
  • Determine whether the client is an approved application, DBA workstation, migration host, or automation service.
  • Search earlier events on the same network.community_id for listDatabases, listCollections, usersInfo, or rolesInfo, which may indicate reconnaissance before destruction.
  • Search subsequent activity for database or collection creation and ransom-related strings such as README, RECOVER, bitcoin, or meow.
  • Confirm the operation and affected resources in MongoDB audit logs and assess whether data was deleted.

False positive analysis

  • Schema migrations and test cleanup can legitimately drop collections or indexes.
  • Authorized identity lifecycle operations can drop users or roles.
  • Scope exceptions to approved clients and maintenance windows rather than excluding command names globally.

Response and remediation

  • Block the client and isolate the MongoDB service if the activity is unauthorized.
  • Preserve MongoDB audit logs and packet evidence, identify affected databases, and begin recovery from immutable backups.
  • Rotate database credentials, remove unauthorized users or roles, and restrict MongoDB network access to approved application and administration hosts.

Setup

edit

Setup

This rule requires the Elastic Network Packet Capture integration with the MongoDB protocol analyzer enabled and cleartext visibility into MongoDB transactions. TLS-encrypted or compressed MongoDB wire traffic may not expose network_traffic.mongodb.query. Modern OP_MSG traffic often reports network_traffic.mongodb.method as msg, so the query-text branch is required. Use MongoDB audit logs for authoritative user attribution and operation outcomes.

Rule query

edit
data_stream.dataset:network_traffic.mongodb and
(
  network_traffic.mongodb.method:(
    "dropDatabase" or "drop" or "dropIndexes" or
    "dropAllUsersFromDatabase" or "dropAllRolesFromDatabase"
  ) or
  (
    network_traffic.mongodb.method:"msg" and
    network_traffic.mongodb.query:(
      *dropDatabase* or *dropIndexes* or
      *dropAllUsersFromDatabase* or *dropAllRolesFromDatabase* or
      *\"drop\"*
    )
  )
)

Framework: MITRE ATT&CKTM

« Successful AMQP Multi-Queue Purge Burst First Time Seen Memcached Writer »