Threat actors who successfully obtain privileged database credentials often exploit this feature to bypass typical application-layer restrictions. By initiating a COPY statement containing the PROGRAM keyword, attackers can spawn shells (e.g., bash, sh), execute downloaders (curl, wget), or run malicious payloads like cryptominers directly within the security context of the PostgreSQL service account. This technique is well-documented in various post-compromise scenarios, including widespread automated cryptomining campaigns that target exposed or weakly protected database instances. Defenders should monitor database query traffic for the presence of the PROGRAM keyword within COPY statements to detect unauthorized process execution.

Attack Chain

1. An attacker gains access to the database using compromised or brute-forced superuser credentials.
2. The attacker identifies the database as a target for persistence or resource exploitation (e.g., cryptomining).
3. The attacker issues a COPY ... FROM PROGRAM or COPY ... TO PROGRAM SQL statement via an active database session.
4. The PostgreSQL process engine parses the PROGRAM keyword and invokes the specified command through an OS shell.
5. The OS shell executes the attacker's payload (e.g., a shell script or binary) using the privileges of the postgres service account.
6. The payload performs subsequent malicious actions, such as establishing a reverse shell, downloading additional malware, or initiating cryptomining processes.
7. The attacker maintains persistence by leveraging the shell access to install backdoors or scheduled tasks on the underlying host.

Impact

Successful exploitation allows for arbitrary code execution on the database server, leading to potential data exfiltration, ransomware deployment, or long-term resource hijacking for cryptomining. These campaigns can impact any organization running PostgreSQL where database access controls are insufficient or where the pg_execute_server_program privilege is assigned to non-administrative service accounts.

Recommendation

• Monitor network query logs for any COPY SQL statement containing the PROGRAM keyword using the provided Sigma rule.
• Audit database roles to ensure that pg_execute_server_program privileges are restricted strictly to authorized administrative accounts.
• Implement endpoint process monitoring to detect the PostgreSQL service account spawning unauthorized child processes such as sh, bash, curl, wget, or cryptomining binaries.
• Review PostgreSQL audit logs and network traffic for suspicious database activity, including unusual enumeration or unexpected queries following successful authentication.
• Deploy the Sigma rule below to detect potentially malicious COPY statements in network telemetry.