PostgreSQL Connection String Enumeration via Grep

Swachchhanda Shrawan Poudel (Nextron Systems)

Detects the use of grep to search for PostgreSQL connection strings and database URLs, which may indicate credential harvesting from application directories as a precursor to lateral movement or data exfiltration. Attackers may use this technique to find hardcoded database credentials in source code, configuration files, or environment variable definitions.

2026-08-07 00:00:00

None

7b3f2e91-0d4c-4a58-b7e6-5c8d1f9a3e02

attack.credential-access attack.discovery attack.t1552.001 attack.collection attack.t1213

Nextron Sigma feed only (private)