Loading

First-Time Destructive MongoDB Command from a Client IP

Identifies the first client IP observed issuing MongoDB commands that can drop databases, collections, indexes, users, or roles within a five-day history window. Adversaries with access to an exposed or compromised MongoDB service may use these commands to destroy data, disrupt applications, or prepare a wipe-and-extort attack.

Rule type: new_terms
Rule indices:

  • logs-network_traffic.mongodb-*

Rule Severity: high
Risk Score: 73
Runs every:
Searches indices from: now-9m
Maximum alerts per execution: 100
References:

Tags:

  • Domain: Network
  • Use Case: Network Security Monitoring
  • Use Case: Threat Detection
  • Tactic: Impact
  • Data Source: Network Packet Capture
  • Resources: Investigation Guide

Version: 1
Rule authors:

  • Elastic

Rule license: Elastic License v2

This rule requires the Elastic Network Packet Capture integration with the MongoDB protocol analyzer enabled and cleartext visibility into MongoDB transactions. TLS-encrypted or compressed MongoDB wire traffic may not expose network_traffic.mongodb.query. Modern OP_MSG traffic often reports network_traffic.mongodb.method as msg, so the query-text branch is required. Use MongoDB audit logs for authoritative user attribution and operation outcomes.

MongoDB wipe-and-extort campaigns commonly enumerate databases before dropping databases or collections and inserting a ransom note. This rule detects the first client IP observed issuing decoded MongoDB commands capable of destructive schema, data, identity, or access changes within a five-day history window.

  • Review client.ip, server.ip, network.community_id, network_traffic.mongodb.method, network_traffic.mongodb.query, network_traffic.mongodb.resource, and network_traffic.mongodb.fullCollectionName.
  • Determine whether the client is an approved application, DBA workstation, migration host, or automation service.
  • Search earlier events on the same network.community_id for listDatabases, listCollections, usersInfo, or rolesInfo, which may indicate reconnaissance before destruction.
  • Search subsequent activity for database or collection creation and ransom-related strings such as README, RECOVER, bitcoin, or meow.
  • Confirm the operation and affected resources in MongoDB audit logs and assess whether data was deleted.
  • Schema migrations and test cleanup can legitimately drop collections or indexes.
  • Authorized identity lifecycle operations can drop users or roles.
  • Scope exceptions to approved clients and maintenance windows rather than excluding command names globally.
  • Block the client and isolate the MongoDB service if the activity is unauthorized.
  • Preserve MongoDB audit logs and packet evidence, identify affected databases, and begin recovery from immutable backups.
  • Rotate database credentials, remove unauthorized users or roles, and restrict MongoDB network access to approved application and administration hosts.
data_stream.dataset:network_traffic.mongodb and
(
  network_traffic.mongodb.method:(
    "dropDatabase" or "drop" or "dropIndexes" or
    "dropAllUsersFromDatabase" or "dropAllRolesFromDatabase"
  ) or
  (
    network_traffic.mongodb.method:"msg" and
    network_traffic.mongodb.query:(
      *dropDatabase* or *dropIndexes* or
      *dropAllUsersFromDatabase* or *dropAllRolesFromDatabase* or
      *\"drop\"*
    )
  )
)

Framework: MITRE ATT&CK