Metabase Unpatched Flaw, MCP Supply-Chain Attacks, and Router Backdoors: Defender's Playbook for This Week's Threat Recap

---
title: Metabase Java Process Spawning Shell or Script Interpreter
id: 4c2e9a71-8b3f-4d12-a6e7-9f1b3c5d8a02
status: experimental
description: Detects the Metabase Java process spawning shells, script interpreters, or download tools — a strong indicator of RCE exploitation. Metabase should never execute child shells in normal operation.
references:
  - https://thehackernews.com/2026/08/weekly-recap-ai-goes-rogue-metabase-0.html
  - https://attack.mitre.org/techniques/T1190/
author: Security Arsenal
date: 2026/08/08
tags:
  - attack.initial_access
  - attack.t1190
  - attack.execution
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentCommandLine|contains:
      - 'metabase.jar'
      - 'metabase'
  selection_child:
    CommandLine|contains:
      - '/bin/sh'
      - '/bin/bash'
      - 'curl '
      - 'wget '
      - 'python'
      - 'nc '
      - 'ncat'
      - 'base64'
  condition: selection_parent and selection_child
falsepositives:
  - Custom Metabase plugins executing system commands (rare; verify with app team)
level: critical
---
title: MCP Server Runtime Spawning Network or Reconnaissance Tooling
id: 8d5f2b94-1c7a-4e35-b2d8-6a9c4e7f1b35
status: experimental
description: Detects Node.js or Python processes launched from MCP server directories executing network tools, credential-file access, or package installs — consistent with trojanized MCP server packages or prompt-injection-driven tool abuse.
references:
  - https://thehackernews.com/2026/08/weekly-recap-ai-goes-rogue-metabase-0.html
  - https://attack.mitre.org/techniques/T1195/
author: Security Arsenal
date: 2026/08/08
tags:
  - attack.initial_access
  - attack.t1195.002
  - attack.credential_access
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentCommandLine|contains:
      - 'mcp-server'
      - 'modelcontextprotocol'
      - 'mcp_server'
      - '.cursor'
      - 'Claude'
  selection_child:
    CommandLine|contains:
      - 'curl'
      - 'wget'
      - 'Invoke-WebRequest'
      - 'certutil'
      - 'nc '
      - 'npm install'
      - 'pip install'
      - '.aws'
      - 'id_rsa'
      - 'credentials'
  condition: selection_parent and selection_child
falsepositives:
  - Legitimate MCP integrations that perform package management or cloud operations — baseline and allowlist by server name
level: high
---
title: Outbound Connection from AI Assistant or MCP Runtime to Rare External Host
id: 2b7c4e15-9d3a-4f81-c5e2-8a6b1d4f9c73
status: experimental
description: Detects AI client or MCP server processes establishing outbound connections, which may indicate data exfiltration by a malicious MCP package or rogue agent behavior. Tune by allowlisting known API endpoints (anthropic.com, openai.com, etc.).
references:
  - https://thehackernews.com/2026/08/weekly-recap-ai-goes-rogue-metabase-0.html
  - https://attack.mitre.org/techniques/T1041/
author: Security Arsenal
date: 2026/08/08
tags:
  - attack.exfiltration
  - attack.t1041
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    Image|contains:
      - '\node.exe'
      - '\python.exe'
      - 'Claude'
      - 'cursor'
  filter_known:
    DestinationHostname|endswith:
      - '.anthropic.com'
      - '.openai.com'
      - '.github.com'
      - '.npmjs.org'
      - '.microsoft.com'
  condition: selection and not filter_known
falsepositives:
  - MCP servers legitimately connecting to third-party SaaS APIs — maintain an allowlist per approved server
level: medium

// Hunt: Metabase (or any long-running Java service) spawning suspicious child processes
// Works via Defender for Endpoint, or Sysmon forwarded to Sentinel
DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where InitiatingProcessCommandLine has_any ("metabase", "metabase.jar")
   or (InitiatingProcessFileName =~ "java" and InitiatingProcessCommandLine has "metabase")
| where FileName in~ ("sh", "bash", "dash", "curl", "wget", "python", "python3", "nc", "ncat", "base64", "powershell.exe", "cmd.exe")
| project TimeGenerated, DeviceName, AccountName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, RemoteIP, RemoteUrl
| order by TimeGenerated desc
;
// Hunt: MCP / AI-assistant child processes touching credential material or network tooling
DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where InitiatingProcessCommandLine has_any ("mcp", "modelcontextprotocol", "claude", "cursor")
   or InitiatingProcessFolderPath has_any ("mcp-server", ".cursor", "Claude")
| where ProcessCommandLine has_any (".aws", "id_rsa", ".ssh", "credentials", "Invoke-WebRequest", "certutil", "curl", "wget", "npm install", "pip install", "base64")
| project TimeGenerated, DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine
| order by TimeGenerated desc

-- Hunt for Metabase exploitation and MCP runtime abuse artifacts
-- Target: suspicious child processes of Java/Metabase and MCP runtimes, plus persistence on developer workstations

-- Section 1: Metabase or Java processes with suspicious children
SELECT Pid, Ppid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE CommandLine =~ '(?i)(/bin/sh|/bin/bash|curl |wget |nc |base64)'
  AND Ppid IN (
      SELECT Pid FROM pslist()
      WHERE CommandLine =~ '(?i)metabase'
  )

-- Section 2: Node/Python processes launched from MCP-related paths executing risky commands
SELECT Pid, Ppid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE CommandLine =~ '(?i)(\.aws|id_rsa|credentials|Invoke-WebRequest|certutil|npm install|pip install)'
  AND (
      Exe =~ '(?i)(node|python)'
   OR CommandLine =~ '(?i)(mcp|modelcontextprotocol)'
  )

-- Section 3: Outbound connections from AI/MCP runtime processes
SELECT Pid, Name, Family, Type, Status, Laddr, Raddr
FROM netstat()
WHERE Name =~ '(?i)(node|python|claude|cursor)'
  AND Status =~ 'ESTABLISHED'
  AND NOT Raddr.IP =~ '^(10\.|192\.168\.|172\.(1[6-9]|2[0-9]|3[01])\.|127\.)'

#!/bin/bash
# Metabase + MCP + Router exposure verification script (Linux)
# Run on Metabase hosts and developer workstations; requires appropriate privileges

echo "=== [1] Metabase Version & Exposure Check ==="
if command -v docker &>/dev/null; then
    docker ps --format '{{.Image}} {{.Names}}' | grep -i metabase && \
    echo "[!] Metabase container found — verify image tag against latest release at https://github.com/metabase/metabase/releases"
fi
find /opt /srv /home -maxdepth 3 -name 'metabase.jar' 2>/dev/null | while read -r jar; do
    echo "[!] Found: $jar"
    unzip -p "$jar" metabase/public/version-info.properties 2>/dev/null | grep -i version
    echo "    Compare against https://www.metabase.com/docs/latest/releases"
done

echo ""
echo "=== [2] Is Metabase internet-facing? Check listeners & reverse proxy ==="
ss -tlnp 2>/dev/null | grep -E ':(3000|80|443) ' || echo "[-] No common web listeners found"

echo ""
echo "=== [3] MCP Server Audit — enumerate installed MCP configs ==="
for cfg in ~/.cursor/mcp.json ~/.config/Claude/claude_desktop_config.json ~/Library/Application\ Support/Claude/claude_desktop_config.json; do
    if [ -f "$cfg" ]; then
        echo "[!] MCP config found: $cfg"
        grep -oE '"(command|args)": *"[^"]+"' "$cfg" | head -40
    fi
done

echo ""
echo "=== [4] Audit MCP package provenance (npm/pip) ==="
grep -rlE '"mcp' ~/ 2>/dev/null --include='package.json' | head -10 | while read -r pkg; do
    dir=$(dirname "$pkg")
    echo "[*] $dir"
    (cd "$dir" && npm audit --json 2>/dev/null | grep -oE '"(critical|high)":[0-9]+' | head -4)
done

echo ""
echo "=== [5] Network edge: check for exposed router management interfaces ==="
echo "Run from a scanner host with visibility of your perimeter:"
echo "  nmap -Pn -p 80,443,8080,8443,23,22 --open <your_public_ranges>"
echo "  Flag ANY router/firewall admin interface reachable from the internet."

echo ""
echo "=== [6] Baseline Metabase process tree (detect post-exploitation children) ==="
ps -eo pid,ppid,comm,args --forest 2>/dev/null | grep -A3 -i metabase || echo "[-] No Metabase process currently running"