# Agentic DB Extortion Pipeline

- **Severity:** High
- **Signature ID:** `7f3c1d0a-5b2e-4a41-9c86-2d4b9f0e6a13`
- **MITRE ATLAS:** AML.T0025 (Exfiltration via Cyber Means)
- **OWASP:** LLM06 (Excessive Agency)

## Summary

This rule spots command lines where someone dumps a database, encrypts the output, and pushes it straight over a raw network connection in one go, or destroys a database while a ransom note or payment demand sits in the same command. Both patterns match the JADEPUFFER-style extortion playbook where data is stolen and/or destroyed for leverage.

## How the attack works

An attacker (or an AI agent executing on their behalf) runs a database dump tool and pipes its output through an encryption or password-protected archiving step, then immediately sends that output over an ad-hoc network channel such as curl, nc, socat, telnet, or a raw /dev/tcp socket, all in a single shell command. Alternatively, the attacker runs a destructive database command like DROP DATABASE, TRUNCATE TABLE, or FLUSHALL, and includes a ransom note or payment reference in the same command line. The rule only fires when all required stages appear together in one command; it does not track separate steps executed at different times.

## Why it matters

An organisation loses confidentiality of database contents if data is exfiltrated, and availability of the database if it is destroyed, and may face an extortion demand tied to either. This detects only the single command-line moment where dump+encrypt+exfil or destroy+ransom-text collide, not the reconnaissance, access, or lateral movement that led up to it.

## What you can do

- Require database backup and export jobs to use named backup agents, file sinks, or approved transports (scp/ssh, rclone, cloud CLI) instead of ad-hoc pipelines through curl, nc, or raw sockets.
- Restrict which service accounts or roles can run destructive commands like DROP DATABASE, TRUNCATE, or FLUSHALL, and require change review for schema drops.
- Review any alert manually since this is a single detection point, not full kill-chain coverage - confirm whether the command came from a legitimate DBA/SRE script, a purple-team exercise, or an unauthorized actor.
- Log and retain full command-line arguments for database client processes so this kind of pattern can be reviewed after the fact, not just at execution time.

## Known benign look-alikes

- A DBA or SRE one-liner that dumps a database, encrypts it with openssl/gpg/7z and pushes it to an internal collector with curl or nc in a single pipeline. Rare (the common shapes - file sink, ssh/scp, rclone, cloud CLI - are excluded from the egress set), and report-only, but this is the main legitimate collision.
- Purple-team or detection-engineering exercises intentionally replaying JADEPUFFER-style dump-encrypt-exfil or drop-and-ransom-note commands.
- A migration or teardown script that drops a schema in an environment where a database, table or output file is genuinely named something like restore_data or recover_db - branch B additionally requires a ransom-note or payment string, so this only collides when both appear in the same command line.
- Incident-response tooling that runs a database dump through encryption before shipping evidence off a compromised host.
- Documentation generation, heredoc script authoring, and grep/man over backup scripts - suppressed by filter_docgen / filter_search; the eventual execution of the generated script still produces its own matching execute_process event.

## References

- https://attack.mitre.org/techniques/T1486/
- https://attack.mitre.org/techniques/T1485/
- https://attack.mitre.org/techniques/T1048/
- https://atlas.mitre.org/techniques/AML.T0025

---
Source: https://www.netzilo.com/threats/agentic-db-extortion-pipeline