JPCERT/CC Alert: Mobile API Abuse and Metabase Exploitation Driving Japan's Data Leak Surge — Detection and Hardening Guide

---
title: Metabase Java Process Spawning Shell or Command Interpreter
id: 8f3a2b41-7c1e-4d9a-b5f6-2e8c1a4d7b90
status: experimental
description: Detects the Metabase JVM spawning command shells or scripting interpreters, a hallmark of post-exploitation following known Metabase RCE flaws. Legitimate Metabase operation never spawns child shells.
references:
  - https://attack.mitre.org/techniques/T1190/
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/10/09
tags:
  - attack.initial_access
  - attack.t1190
  - attack.execution
  - attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\java.exe'
      - '\javaw.exe'
  selection_cmdline:
    ParentCommandLine|contains:
      - 'metabase'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\certutil.exe'
      - '\curl.exe'
      - '\bitsadmin.exe'
  condition: selection_parent and selection_cmdline and selection_child
falsepositives:
  - Extremely rare; custom Metabase plugins or wrappers invoking external tools
level: critical
---
title: Metabase JVM Spawning Shell on Linux
id: 3c7e9d52-4a8b-4f21-9c63-1b5d7e2a8f34
status: experimental
description: Detects a Java process associated with Metabase spawning shells or download utilities on Linux, indicating successful exploitation of a known Metabase vulnerability.
references:
  - https://attack.mitre.org/techniques/T1190/
author: Security Arsenal
date: 2026/10/09
tags:
  - attack.initial_access
  - attack.t1190
  - attack.execution
  - attack.t1059.004
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentCommandLine|contains:
      - 'metabase'
  selection_child:
    Image|endswith:
      - '/sh'
      - '/bash'
      - '/dash'
      - '/zsh'
      - '/curl'
      - '/wget'
      - '/python'
      - '/python3'
      - '/nc'
      - '/ncat'
  condition: selection_parent and selection_child
falsepositives:
  - Rare; container healthchecks or orchestration wrappers that exec into the Metabase container
level: critical
---
title: External Probing of Metabase Internal API Endpoints
id: 5b1d8f73-2e4a-4c96-a7d8-9f3b6c1e5a27
status: experimental
description: Detects HTTP requests to Metabase setup and session properties endpoints from external sources, consistent with pre-exploitation reconnaissance against internet-exposed instances.
references:
  - https://attack.mitre.org/techniques/T1190/
  - https://attack.mitre.org/techniques/T1595.002/
author: Security Arsenal
date: 2026/10/09
tags:
  - attack.reconnaissance
  - attack.t1595.002
  - attack.initial_access
  - attack.t1190
logsource:
  category: webserver
detection:
  selection_uri:
    cs-uri|contains:
      - '/api/setup'
      - '/api/session/properties'
      - '/api/util/password_check'
  selection_status:
    sc-status:
      - 200
      - 401
      - 403
  condition: selection_uri and selection_status
falsepositives:
  - Legitimate Metabase admin access from internal networks (filter by source IP range)
  - Authorized vulnerability scanning
level: high

// Hunt 1: Mobile API abuse — bulk sequential enumeration of object identifiers
// Tune ApiPathRegex to your actual API route structure (e.g. /api/v1/users/)
let ApiPathRegex = @"/api/[^\s]*/[0-9]{3,}";
let Threshold = 200;
CommonSecurityLog
| where TimeGenerated > ago(24h)
| where RequestURL matches regex ApiPathRegex
| summarize RequestCount = count(),
            DistinctIds = dcount(tostring(extract(ApiPathRegex, 0, RequestURL))),
            FirstSeen = min(TimeGenerated),
            LastSeen = max(TimeGenerated)
    by SourceIP, RequestUserAgent, RequestURL
| where RequestCount > Threshold
| extend RequestsPerMinute = RequestCount / max_of(1.0, datetime_diff("minute", LastSeen, FirstSeen))
| where RequestsPerMinute > 10
| project FirstSeen, LastSeen, SourceIP, RequestCount, RequestsPerMinute, RequestUserAgent, RequestURL
| order by RequestCount desc;

// Hunt 2: Metabase reconnaissance and exploitation attempts in IIS / web logs
// Works against W3CIISLog (AMA) or CommonSecurityLog from a reverse proxy/WAF
W3CIISLog
| where TimeGenerated > ago(7d)
| where csUriStem has_any ("/api/setup", "/api/session/properties", "/api/util/password_check")
    or csUriQuery has_any ("jdbc", "h2", "ALLOW_LITERALS", "INIT RUNSCRIPT")
| summarize Hits = count(), DistinctURIs = dcount(csUriStem),
            StatusCodes = make_set(scStatus),
            UserAgents = make_set(csUserAgent)
    by cIP, Computer
| project cIP, Computer, Hits, StatusCodes, DistinctURIs, UserAgents
| order by Hits desc;

// Hunt 3: Metabase JVM spawning shells — Defender for Endpoint
DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where InitiatingProcessFileName in~ ("java.exe", "javaw.exe", "java")
| where InitiatingProcessCommandLine has "metabase"
| where FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "sh", "bash", "curl", "wget", "nc")
| project TimeGenerated, DeviceName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, AccountName
| order by TimeGenerated desc;

-- Hunt: Metabase compromise indicators — JVM child processes and network exposure
-- Run against servers hosting Metabase instances

-- Part 1: Shells or tooling spawned by the Metabase Java process
SELECT Pid, Ppid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE (Name =~ '(?i)java' AND CommandLine =~ '(?i)metabase')
   OR (Ppid IN (
       SELECT Pid FROM pslist()
       WHERE Name =~ '(?i)java' AND CommandLine =~ '(?i)metabase'
   ))

-- Part 2: Listening ports — flag Metabase default port 3000 and unexpected listeners
SELECT Pid, Name, Status,
       Laddr.IP AS LocalIP, Laddr.Port AS LocalPort,
       Raddr.IP AS RemoteIP, Raddr.Port AS RemotePort
FROM netstat()
WHERE Status =~ 'LISTEN'
  AND (LocalPort = 3000
       OR Name =~ '(?i)java')

-- Part 3: Outbound connections from the Metabase JVM (egress C2 or data theft)
SELECT Pid, Name, Raddr.IP AS RemoteIP, Raddr.Port AS RemotePort, Status
FROM netstat()
WHERE Name =~ '(?i)java'
  AND Status =~ 'ESTABLISHED'
  AND NOT (RemoteIP =~ '^(10\.|172\.(1[6-9]|2[0-9]|3[0-1])\.|192\.168\.)')

#!/bin/bash
# Metabase exposure and hardening verification — run as root or via sudo
set -e

echo "=== [1] Identify Metabase version and process ==="
METABASE_JAR=$(find /opt /srv /home /usr/local -name "metabase.jar" 2>/dev/null | head -1)
if [ -n "$METABASE_JAR" ]; then
  echo "Found: $METABASE_JAR"
  unzip -p "$METABASE_JAR" metabase/version.properties 2>/dev/null || echo "Version unreadable — check release notes against your deployed build"
else
  ps aux | grep -i metabase | grep -v grep || echo "No Metabase process detected"
fi

echo ""
echo "=== [2] Check if Metabase is internet-exposed on default port ==="
ss -tlnp | grep -E ':(3000|80|443)' || echo "No listeners on common web ports"

echo ""
echo "=== [3] Verify setup endpoints are unreachable (should return 404/403) ==="
for endpoint in /api/setup /api/session/properties /api/util/password_check; do
  code=$(curl -sk -o /dev/null -w "%{http_code}" --max-time 5 "http://localhost:3000${endpoint}")
  echo "${endpoint} -> HTTP ${code}"
done

echo ""
echo "=== [4] Detect JVM spawning shells (post-exploitation IOC) ==="
METABASE_PID=$(pgrep -f "metabase" | head -1)
if [ -n "$METABASE_PID" ]; then
  echo "Metabase PID: $METABASE_PID"
  ps --ppid "$METABASE_PID" -o pid,comm,args 2>/dev/null || echo "No child processes (expected)"
fi

echo ""
echo "=== [5] Enforce egress restriction for the metabase user ==="
# Block outbound internet access for the Metabase service account while
# permitting database traffic. Adjust DB subnet/ports to your environment.
METABASE_USER=$(ps -o user= -p "$METABASE_PID" 2>/dev/null || echo "metabase")
iptables -C OUTPUT -m owner --uid-owner "$METABASE_USER" -p tcp --dport 443 -j DROP 2>/dev/null || \
iptables -A OUTPUT -m owner --uid-owner "$METABASE_USER" -p tcp --dport 443 -j DROP
iptables -C OUTPUT -m owner --uid-owner "$METABASE_USER" -p tcp --dport 80 -j DROP 2>/dev/null || \
iptables -A OUTPUT -m owner --uid-owner "$METABASE_USER" -p tcp --dport 80 -j DROP
echo "Egress blocked for HTTP/HTTPS from user: ${METABASE_USER}"

echo ""
echo "=== [6] Audit reverse proxy: deny legacy setup endpoints ==="
cat <<'EOF'
Add to your nginx/Apache config in front of Metabase:

  location ~ ^/api/(setup|util/password_check) {
      deny all;
      return 404;
  }

Also enforce: Metabase must sit behind SSO-authenticated reverse proxy,
never directly on the internet.
EOF

echo ""
echo "=== DONE. Update Metabase to the latest release immediately if out of date. ==="