First-Time Destructive MongoDB Command from a Client IP

Last updated 3 days ago on 2026-07-30

Created 3 days ago on 2026-07-30

About

Identifies the first client IP observed issuing MongoDB commands that can drop databases, collections, indexes, users, or roles within a five-day history window. Adversaries with access to an exposed or compromised MongoDB service may use these commands to destroy data, disrupt applications, or prepare a wipe-and-extort attack.

Tags

Domain: NetworkUse Case: Network Security MonitoringUse Case: Threat DetectionTactic: ImpactData Source: Network Packet CaptureLanguage: kuery

Severity

high

Risk Score

MITRE ATT&CK™

Impact (TA0040)(external, opens in a new tab or window)

↳ Data Destruction (T1485)(external, opens in a new tab or window)

False Positive Examples

Database administrators, deployment automation, test teardown jobs, and schema migration tools may issue destructive commands legitimately. Validate the client address, target resource, change window, and associated administrator activity before escalating.

License

Elastic License v2(external, opens in a new tab or window)

Definition

Rule Type: New Terms Rule
Integration Pack: Prebuilt Security Detection Rules
Index Patterns: logs-network_traffic.mongodb-*
Related Integrations: network_traffic(external, opens in a new tab or window)
Query

✄𐘗text code block:
✄𐘗data_stream.dataset:network_traffic.mongodb and
(
  network_traffic.mongodb.method:(
    "dropDatabase" or "drop" or "dropIndexes" or
    "dropAllUsersFromDatabase" or "dropAllRolesFromDatabase"
  ) or
  (
    network_traffic.mongodb.method:"msg" and
    network_traffic.mongodb.query:(
      *dropDatabase* or *dropIndexes* or
      *dropAllUsersFromDatabase* or *dropAllRolesFromDatabase* or
      *\"drop\"*
    )
  )
)

Install detection rules in Elastic Security

Detect First-Time Destructive MongoDB Command from a Client IP in the Elastic Security detection engine by installing this rule into your Elastic Stack.

To setup this rule, check out the installation guide for Prebuilt Security Detection Rules(external, opens in a new tab or window).