DB program spawned process

rule: DB program spawned process
desc: 'A program related to the database server creates an unexpected child process
  (other than itself). This is not supposed to happen and often follows SQL injection
  attacks. This behavioral detection could indicate potential unauthorized data extraction
  or tampering with the database.

  '
condition: 'spawned_process and proc.pname in (db_server_binaries) and not proc.name
  in (db_server_binaries) and not postgres_running_wal_e and not user_known_db_spawned_processes

  '
output: Database-related program spawned process other than itself | evt_type=%evt.type
  user=%user.name user_uid=%user.uid user_loginuid=%user.loginuid process=%proc.name
  proc_exepath=%proc.exepath parent=%proc.pname command=%proc.cmdline terminal=%proc.tty
  exe_flags=%evt.arg.flags
priority: NOTICE
tags:
- maturity_incubating
- host
- container
- process
- database
- mitre_execution
- T1190