Postgres pg_dump Execution Followed by Deletion of Staged Loot Files

Duo Tech@duotech

•updated Jul 8, 2026•1•0•0

Detects instances where the 'pg_dump' database utility is executed, followed by the deletion of a file within a one-hour window by the same agent. This behavior is indicative of an attacker extracting sensitive database contents and subsequently attempting to remove evidence of the dump or staging files.