PostgreSQL pg_hba.conf Broad Replication Access + Unexpected Source

Arnold Chan@slaz

•updated Sep 7, 2026•0•0•0

This rule detects modifications to the PostgreSQL authentication configuration file (pg_hba.conf), which controls client authentication. It also identifies replication connection requests from source IP addresses that have not been observed in the previous 7 days, indicating a potential attempt to exfiltrate database data via unauthorized replication.