PostgreSQL COPY PROGRAM Command Execution

Last updated 3 days ago on 2026-07-30

Created 3 days ago on 2026-07-30

About

Identifies PostgreSQL "COPY" statements that invoke an operating-system command through the "PROGRAM" option. A superuser or role with "pg_execute_server_program" can use this feature to execute arbitrary commands as the PostgreSQL service account, a technique used after credential compromise and by cryptomining campaigns.

Tags

Domain: NetworkUse Case: Network Security MonitoringUse Case: Threat DetectionTactic: ExecutionData Source: Network Packet CaptureLanguage: eql

Severity

high

Risk Score

MITRE ATT&CK™

Execution (TA0002)(external, opens in a new tab or window)

↳ Command and Scripting Interpreter (T1059)(external, opens in a new tab or window)

False Positive Examples

Database administrators and scheduled data-processing jobs may legitimately use COPY PROGRAM for import or export workflows. Confirm the command, client address, database role, maintenance context, and resulting process activity before escalating.

License

Elastic License v2(external, opens in a new tab or window)

Definition

Rule Type: Event Correlation Rule
Integration Pack: Prebuilt Security Detection Rules
Index Patterns: logs-network_traffic.pgsql-*
Related Integrations: network_traffic(external, opens in a new tab or window)
Query

✄𐘗text code block:
✄𐘗any where data_stream.dataset == "network_traffic.pgsql" and
    (
        network_traffic.pgsql.query like~ "*copy*from*program*" or
        network_traffic.pgsql.query like~ "*copy*to*program*"
    )

Install detection rules in Elastic Security

Detect PostgreSQL COPY PROGRAM Command Execution in the Elastic Security detection engine by installing this rule into your Elastic Stack.

To setup this rule, check out the installation guide for Prebuilt Security Detection Rules(external, opens in a new tab or window).