This rule detects PostgreSQL COPY ... FROM PROGRAM and COPY ... TO PROGRAM statements that execute an operating-system command via the PROGRAM option. When a database superuser or a role granted pg_execute_server_program is compromised, an attacker can run arbitrary commands as the PostgreSQL service account, enabling shells, payload downloads, persistence, or cryptomining from the server process. The detection targets network traffic captured for PostgreSQL (network_traffic.pgsql) and matches queries that contain the COPY ... PROGRAM pattern. Visibility relies on a Network Packet Capture integration; TLS encryption, prepared statements, packet loss, or incomplete capture can obscure command text, so corroborate findings with PostgreSQL audit logs and endpoint telemetry to confirm the database identity and command execution outcome. False positives can arise from legitimate COPY PROGRAM usage for ETL, backups, or administrative automation; apply scoped, documented exceptions rather than broad exclusions of PROGRAM. Response steps include terminating the offending session, isolating the server, preserving evidence, rotating credentials, and revoking unnecessary superuser and pg_execute_server_program privileges. This rule complements broader incident response and should be correlated with host and network indicators to confirm command execution and actor behavior.