« First-Time Destructive MongoDB Command from a Client IP Thrift RPC Method from an External Client »
Elastic Docs ›Elastic Security [8.19] ›Downloadable rule update v8.19.29

First Time Seen Memcached Writer

edit
IMPORTANT: This documentation is no longer updated. Refer to Elastic's version policy and the latest documentation.

First Time Seen Memcached Writer

edit

Identifies the first successful or no-reply Memcached store command from a client to a server. Memcached commonly has no authentication, so an unauthorized writer can overwrite session tokens, poison cached application content, or alter security-sensitive state. This behavior can enable session hijacking such as the exposure described by CVE-2026-29093.

Rule type: new_terms

Rule indices:

  • logs-network_traffic.memcached-*

Severity: medium

Risk score: 47

Runs every: 5m

Searches indices from: now-9m (Date Math format, see also Additional look-back time)

Maximum alerts per execution: 100

References:

Tags:

  • Domain: Network
  • Use Case: Network Security Monitoring
  • Use Case: Threat Detection
  • Tactic: Impact
  • Data Source: Network Packet Capture
  • Resources: Investigation Guide

Version: 1

Rule authors:

  • Elastic

Rule license: Elastic License v2

Investigation guide

edit

Triage and analysis

Investigating First Time Seen Memcached Writer

Memcached permits store commands without authentication by default. A client with network access can use set, add, replace, append, prepend, or cas to overwrite session objects or inject content consumed by an application. This rule uses a seven-day new-terms history window to surface the first observed client, Memcached server, and store command combination performing a successful operation or issuing a store command with noreply.

The rule does not inspect cached values and does not prove that a session was hijacked. It identifies an unusual writer relationship that requires application and asset context.

Possible investigation steps

  • Review client.ip, server.ip, server.port, network.community_id, network_traffic.memcached.request.command, network_traffic.memcached.request.keys, network_traffic.memcached.response.type, and network_traffic.memcached.response.status_code.
  • Determine whether the client is an approved application server, cache warmer, administrative host, deployment job, or newly scaled workload.
  • Inspect key names for application-specific session prefixes such as memc.sess.key, PHPSESSID, or session. Do not retrieve or ingest cached values unless incident response requires it and access controls permit it.
  • Search earlier Memcached events from the same client for get, gets, stats, lru_crawler, or key enumeration activity that could indicate discovery before modification.
  • Search subsequent events for flush_all, delete bursts, privileged web sessions from new source addresses or user agents, and administrative actions without the normal authentication sequence.
  • Review application and identity logs to determine whether the write was followed by session reuse or impersonation.

False positive analysis

  • Autoscaling and deployments can introduce legitimate first-time writers.
  • NAT or proxies can combine multiple application instances under one client address or make a known writer appear new.
  • Add exceptions for validated client and server pairs rather than excluding store commands globally.

Response and remediation

  • Block unauthorized clients and restrict Memcached listeners to approved application and administration networks.
  • Invalidate affected sessions and rotate exposed credentials if session manipulation is suspected.
  • Bind Memcached to private interfaces, enforce network-layer access controls, and disable UDP unless explicitly needed.

Setup

edit

Setup

This rule requires the Elastic Network Packet Capture integration with the Memcached protocol analyzer enabled and cleartext visibility into client-to-server transactions. The sensor must observe responses to confirm successful operations, except when the client explicitly uses noreply.

Keep value capture disabled unless it is explicitly required and protected. Cached values can contain live session tokens, credentials, personal data, and other sensitive application content. Key and command metadata are sufficient for this rule.

Rule query

edit
data_stream.dataset:network_traffic.memcached and
client.ip:* and server.ip:* and
network_traffic.memcached.request.command:("set" or "add" or "replace" or "append" or "prepend" or "cas") and
(
  network_traffic.memcached.response.type:("Success" or "success") or
  network_traffic.memcached.response.status_code:0 or
  network_traffic.memcached.request.noreply:true
)

Framework: MITRE ATT&CKTM

« First-Time Destructive MongoDB Command from a Client IP Thrift RPC Method from an External Client »