pstgdump

Hunt Hypothesis

This detection identifies adversary attempts to extract PostgreSQL database schemas and data using the pstgdump utility, a behavior often indicative of reconnaissance or initial data exfiltration preparation. Proactively hunting for this activity in Azure Sentinel is critical because low-severity utility usage can serve as a subtle precursor to larger-scale data theft, allowing analysts to validate legitimate administrative actions against potential unauthorized access before significant impact occurs.

YARA Rule

rule pstgdump
{
meta:
	author = "@patrickrolsen"
	reference = "pstgdump"
strings:
	$s1 = "fgdump\\pstgdump"
	$s2 = "pstgdump"
	$s3 = "Outlook"
condition:
	uint16(0) == 0x5A4D and all of ($s*)
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 3 string patterns in its detection logic.

References

• pstgdump
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the pstgdump detection rule in an enterprise environment, along with suggested filters or exclusions:

• Scheduled Database Backups via Cron

  • Scenario: The database administration team runs nightly automated backups using a cron job on Linux servers. This job executes pg_dump (often aliased as pstgdump in the rule logic) to archive critical PostgreSQL schemas before peak hours, generating high-fidelity alerts every night at 02:00 UTC.
  • Filter/Exclusion: Create a time-based exclusion for the specific host group (e.g., db-prod-01 through db-prod-05) during the maintenance window of 01:30–04:00 UTC. Additionally, filter by the parent process name crond or systemd-cron.

• CI/CD Pipeline Database Migration

  • Scenario: During a deployment pipeline (e.g., Jenkins or GitLab CI), the build agent executes database schema updates. As part of the pre-deployment validation step, the pipeline invokes pstgdump to snapshot the current state before applying migration scripts (using tools like Flyway or Liquibase).
  • Filter/Exclusion: Exclude alerts where the parent process is a known CI runner (e.g., java, node, dockerd) running within the specific network segment of the build servers (10.20.50.0/24). Include a filter for command-line arguments containing flags like --schema-only or specific project identifiers (e.g., -p myapp-prod).

• Third-Party Monitoring Agent Snapshots

  • Scenario: A third-party observability tool, such as Datadog or New Relic Infrastructure Agent, periodically captures database metadata to