This rule detects the first client IP observed issuing MongoDB commands that can destructively modify data or schema within a rolling five-day history window. It analyzes unencrypted network traffic to identify MongoDB operations that drop databases, collections, indexes, users, or roles, using two observation paths: (1) the MongoDB command method in network_traffic.mongodb.method (examples include dropDatabase, drop, dropIndexes, dropAllUsersFromDatabase, dropAllRolesFromDatabase), and (2) OP_MSG traffic where method is "msg" and the textual query contains destructive patterns (e.g., dropDatabase, dropIndexes, dropAllUsersFromDatabase, dropAllRolesFromDatabase, or a literal drop). The rule flags the first-time occurrence per client IP within the specified time window, enabling rapid investigation of potential wipe-and-extort campaigns. It references MITRE ATT&CK technique T1485 (Data Destruction) under the Impact tactic. The detection relies on cleartext MongoDB query text and requires an Elastic Network Packet Capture setup with the MongoDB protocol analyzer enabled; TLS or compressed traffic may obscure query content. The rule is intended to triage high-severity, destructive activity and should be correlated with MongoDB audit logs for attribution and validation. False positives can arise from legitimate database maintenance, deployment automation, or test teardown operations, so confirmation should consider client, target resources, and surrounding admin activity before escalation.