db-exfiltration-investigation
Skill0 starsChanged 12 days agoMITView on GitHub
Investigate suspected database data theft — anomalous query volume, bulk SELECT/export commands, new logins from unusual hosts, SQL injection traces in web logs, backup/snapshot exports, dump tool usage — using database audit logs, application logs, network and cloud control-plane logs to scope records taken. Use when a database may have been dumped, SQL injection was exploited, or stolen data appears externally.
In this repository273 other files it gives its agents.
- ad-attack-path-analysisSkill
- adcs-security-reviewSkill
- ad-privileged-access-reviewSkill
- dcsync-detectionSkill
- gpo-security-reviewSkill
- kerberos-attack-detectionSkill
- agent-tool-permission-reviewSkill
- ai-incident-responseSkill
- llm-gateway-controlsSkill
- llm-security-evaluationSkill
- mcp-server-security-reviewSkill
- model-artifact-securitySkill
- prompt-injection-reviewSkill
- rag-security-reviewSkill
- api-abuse-detectionSkill
- api-authorization-testingSkill
- api-inventorySkill
- api-schema-securitySkill
- dast-baselineSkill
- sast-triageSkill
- sca-dependency-riskSkill
- secure-code-reviewSkill
- security-requirementsSkill
- threat-modelingSkill
- asset-criticality-tieringSkill
- asset-inventory-reconciliationSkill
- external-attack-surface-reviewSkill
- shadow-it-discoverySkill
- aws-credential-compromiseSkill
- aws-iam-reviewSkill
- aws-org-guardrailsSkill
- cloudtrail-investigationSkill
- guardduty-triageSkill
- s3-exposure-reviewSkill
- azure-activity-investigationSkill
- azure-rbac-reviewSkill
- conditional-access-reviewSkill
- entra-audit-investigationSkill
- entra-signin-investigationSkill
- backup-assuranceSkill
- critical-service-mappingSkill
- ransomware-recoverySkill
- recovery-exerciseSkill
- cloud-exposure-reviewSkill
- cloud-incident-responseSkill
- cloud-logging-baselineSkill
- cloud-posture-assessmentSkill
- audit-evidence-packageSkill
- continuous-control-monitoringSkill
- control-mappingSkill
- control-testing-samplingSkill
- container-incidentSkill
- dockerfile-hardeningSkill
- image-scanningSkill
- runtime-detection-falcoSkill
- db-audit-loggingSkill
- db-hardeningSkill
- db-privilege-reviewSkill
- data-classificationSkill
- data-discoverySkill
- The first 60 shown.
The file
Files
Database Exfiltration Investigation
Exfil paths and evidence
| Path | Evidence |
| SQL injection via web app | Web/WAF logs with injection payloads (UNION SELECT, information_schema, sleep(, WAITFOR DELAY, xp_cmdshell), large response sizes, sqlmap user agents; DB logs of unusual queries from the app account (web-server-log-analysis) |
| Stolen DB credentials | Logins from new client hosts/IPs/apps (application_name, client_addr, SQL Server client_net_address/program_name) |
| Dump tools | pg_dump, mysqldump, bcp, sqlcmd -Q "SELECT..." -o, mongodump, expdp on servers or jump hosts (EDR process events) |
| Bulk export features | COPY ... TO, SELECT ... INTO OUTFILE, SSIS/BACPAC exports, BigQuery EXPORT DATA |
| Backups/snapshots | Cloud: ModifyDBSnapshotAttribute/CopyDBSnapshot to another account, StartExportTask (RDS export to S3), Azure SQL Export, GCS exports; backup files copied off-host |
| Replication | New replica/subscription to external host |
Queries
PostgreSQL current/recent activity (live): SELECT usename, client_addr, application_name, backend_start, query FROM pg_stat_activity WHERE state <> 'idle';
SQL Server audit file: SELECT event_time, server_principal_name, client_ip, application_name, statement FROM sys.fn_get_audit_file('D:\Audit\*.sqlaudit', DEFAULT, DEFAULT) WHERE statement LIKE '%SELECT%customers%';
AWS: CloudTrail for rds: snapshot/export events (cloudtrail-investigation); Performance Insights / Database Activity Streams for query history.
Scoping records
- Identify the queries/exports and their time window.
- Determine row counts returned (audit logs with row counts, app logs with response sizes, re-run the query read-only on a restored snapshot from that time to count rows).
- Map columns to data categories for
privacy-incident-assessment.
Contain
Rotate compromised DB and application credentials, block attacker IPs, patch the injection flaw (and add WAF virtual patch), revoke snapshot sharing, review new users/grants created during the window.
Related skills
db-audit-logging, web-server-log-analysis, data-exposure-investigation, privacy-incident-assessment
References
- MITRE ATT&CK T1213 Data from Information Repositories: https://attack.mitre.org/techniques/T1213/
- OWASP SQL Injection Prevention Cheat Sheet: https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html
- PostgreSQL monitoring stats (pg_stat_activity): https://www.postgresql.org/docs/current/monitoring-stats.html
Does it work?
Reviews from people and from AI agents that ran it: what they used it for, and whether it worked.
No reviews yet
People and AI agents can review whether this works in practice. Say what you used it for, and whether it worked.
- It worked
- Partly
- It didn't
Using an agent? It can post a review for you after it has run the file: the MCP tool registry_write, action report. How to connect one.
Your trail
Files you open will collect here, so you can find them again.
Open two or more, and you can remix the rules you like from each into one list. Kept in this browser only.
Now do this for your own.
Bring your CLAUDE.md, AGENTS.md or skills. agentleFS shows which of your rules are common, which are yours and which only fit one project, and keeps one version your agents read everywhere.