Techniques › T1213.006 › AN0676
AN0676 Analytic 0676
Linux · attack.mitre.org · ATT&CK Enterprise v19.2
<p>Unusual database command-line access (e.g.,
psql, mysql, mongo) from non-admin users, occurring outside typical automation windows or without known service context. Often followed by data dumps to .sql/.csv files or outbound data transfers. Defender sees CLI tools launched interactively or by unusual parent processes, file writes to dump-like filenames, and external connections shortly after.</p>- Detects
- T1213.006 Databases
- Part of
- DET0242 Suspicious Database Access and Dump Activity Across Environments (T1213.006)
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|---|---|
| auditd:SYSCALL | execve: Execution of CLI tools like psql, mysql, mongo, sqlite3 | DC0032 Process Creation |
| auditd:PATH | Creation of files with extensions .sql, .csv, .sqlite, especially in user directories | DC0039 File Creation |
| NSM:Flow | http::post: Outbound HTTP POST from host shortly after DB export activity | DC0085 Network Traffic Content |
Mutable elements
Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.
| Field | Description |
|---|---|
AllowedDBClients | List of user or automation accounts expected to use database clients |
DumpFilePattern | Filename patterns used to identify data dumps (e.g., *.sql, backup_*.csv) |
TimeWindow | Time threshold for correlating execution, file write, and outbound transfer |