MexicanMafia Oracle PII Mass Exfiltration via dump_batch.sh and UTL_FILE to /tmp CSV

Ibrahim Saud@tektrix

•updated Jun 25, 2026•0•0•4

Detects the execution of known Oracle database PII exfiltration scripts and patterns associated with the 'MexicanMafia Operation Escaneo' campaign. The rule monitors for specific command-line activity, including the use of extraction scripts like 'dump_oracle_pii.sh', 'fast_extract.py', and database-level exfiltration techniques such as UTL_FILE or sys_eval targeting incremental CSV exports to /tmp.