Detection: MCP Postgres Suspicious Query

 1`mcp_server` method=query direction=inbound
 2
 3| eval dest=host
 4
 5| eval query_lower=lower('params.query')
 6
 7| eval suspicious_query='params.query'
 8
 9| eval is_priv_escalation=if(like(query_lower, "%update%users%role%admin%") OR like(query_lower, "%grant%admin%") OR like(query_lower, "%grant%superuser%"), 1, 0)
10
11| eval is_credential_theft=if(like(query_lower, "%password%") OR like(query_lower, "%credential%") OR like(query_lower, "%api_key%") OR like(query_lower, "%secret%"), 1, 0)
12
13| eval is_recon=if(like(query_lower, "%information_schema%") OR like(query_lower, "%pg_catalog%") OR like(query_lower, "%pg_tables%") OR like(query_lower, "%pg_user%"), 1, 0)
14
15| where is_priv_escalation=1 OR is_credential_theft=1 OR is_recon=1
16
17| eval attack_type=case(
18    is_priv_escalation=1, "Privilege Escalation",
19    is_credential_theft=1, "Credential Theft",
20    is_recon=1, "Schema Reconnaissance",
21    1=1, "Unknown")
22
23| stats count min(_time) as firstTime max(_time) as lastTime values(suspicious_query) as suspicious_queries values(attack_type) as attack_types dc(attack_type) as attack_diversity by dest
24
25| `security_content_ctime(firstTime)` 
26
27| `security_content_ctime(lastTime)`
28
29| table dest firstTime lastTime count suspicious_queries attack_types attack_diversity
30
31| `mcp_postgres_suspicious_query_filter`