Let's say you have a remote client connect to a url to the database. You stream a download through there. You close the connection when you're finished.
No commands run.
No persistent access.
Lawyers are amazing.
Edit: Yes, based on the comment by dherls, this is how they're getting around it. Streaming replication is not commands run by the attackers (it's your own system doing the exfiltration!)
No commands run.
No persistent access.
Lawyers are amazing.
Edit: Yes, based on the comment by dherls, this is how they're getting around it. Streaming replication is not commands run by the attackers (it's your own system doing the exfiltration!)