Detecting Database Dumping and Bulk Export

Attackers who reach a database server or obtain application credentials export tables with the vendor’s own utilities. That makes the process telemetry on database hosts and the query telemetry from the database engine the two best places to look. The goal is separating a person running a dump from the application doing its normal work.

Signals at a Glance

Dump Utilities on the Host

Dump utilities run regularly from backup jobs, so the discriminators are the parent process and the account. A dump launched from an interactive shell, a web-server process or a remote execution service is not a backup:

title: Database Dump Utility Launched From Interactive Or Web Context
logsource:
  category: process_creation
detection:
  tools:
    Image|endswith:
      - '/mysqldump'
      - '/pg_dump'
      - '/pg_dumpall'
      - '/mongodump'
      - '\\mysqldump.exe'
      - '\\pg_dump.exe'
      - '\\bcp.exe'
  bcp_out:
    CommandLine|contains: ' out '
  sqlcmd_export:
    Image|endswith: '\\sqlcmd.exe'
    CommandLine|contains:
      - ' -o '
      - ' -Q '
  suspicious_parent:
    ParentImage|endswith:
      - '/bash'
      - '/sh'
      - '/php-fpm'
      - '/w3wp.exe'
      - '\\cmd.exe'
      - '\\powershell.exe'
  condition: (tools or sqlcmd_export) and suspicious_parent
level: medium
# tune/validate: allowlist scheduled backup users and their parent job runners

Telemetry From the Engine

The engine knows how many rows each statement returned. PostgreSQL’s pg_stat_statements makes the check a single query, and SQL Server, MySQL and Oracle audit logs offer comparable fields:

-- PostgreSQL: statements returning very large result sets, by role
-- tune/validate: requires pg_stat_statements; reset or snapshot to measure windows
SELECT userid::regrole AS role,
       calls,
       rows,
       round(rows::numeric / NULLIF(calls, 0)) AS rows_per_call,
       left(query, 120) AS query_sample
FROM pg_stat_statements
WHERE rows > 1000000
  AND query ILIKE 'select%'
ORDER BY rows DESC
LIMIT 50;

• Compare each account against its own history. A reporting role returning a million rows nightly is routine; the same role returning ten million at 02:00 from a new client address is not.
• Alert on authentication to the database from a host that is not in the application tier, using connection logs or the firewall in front of the database.
• Restrict direct database access for administrators through a bastion or PAM tool, so interactive dumps are logged and attributable.
• Watch for the dump file afterwards: a new large .sql, .bak or .csv file in a temp directory is a staging indicator.