PostgreSQL Replication Account Used Outside Expected Context

Arnold Chan@slaz

•updated Sep 7, 2026•0•0•0

Detects suspicious behavior from database accounts with replication privileges ('rolreplication=true'). The rule monitors for logins from unauthorized IP addresses, the execution of non-replication related SQL commands by these accounts, and the use of potentially malicious plugin names (containing path traversal characters) during replication slot creation.