pg_hba.conf Rewritten to Trust Auth Then Reloaded (PostGREShell)

Arnold Chan@slaz

•updated Sep 7, 2026•1•0•1

Detects modifications to the PostgreSQL configuration file 'pg_hba.conf' closely followed by a reload command (via pg_ctl or postgres processes). This behavior is indicative of an attacker attempting to modify authentication or connection access controls for a database.