---
title: MySQL User-Defined Function Injection
description: Identifies MySQL statements that create a user-defined function backed by a shared library. Adversaries with sufficient database privileges can place...
url: https://www.elastic.co/elastic/docs-builder/docs/3760/reference/security/prebuilt-rules/rules/network/persistence_mysql_udf_injection
products:
  - Elastic Security
---

# MySQL User-Defined Function Injection
Identifies MySQL statements that create a user-defined function backed by a shared library. Adversaries with sufficient
database privileges can place a malicious library in the MySQL plugin directory and register it with "CREATE FUNCTION
... SONAME", establishing a database-resident primitive for operating-system command execution.
**Rule type**: eql
**Rule indices**:
- logs-network_traffic.mysql-*

**Rule Severity**: high
**Risk Score**: 73
**Runs every**: 
**Searches indices from**: `now-9m`
**Maximum alerts per execution**: 100
**References**:
- [[https://legalhackers.com/advisories/MySQL-Exploit-Remote-Root-Code-Execution-Privesc-CVE-2016-6662.html](https://legalhackers.com/advisories/MySQL-Exploit-Remote-Root-Code-Execution-Privesc-CVE-2016-6662.html)](https://legalhackers.com/advisories/MySQL-Exploit-Remote-Root-Code-Execution-Privesc-CVE-2016-6662.html)
- [[https://attack.mitre.org/techniques/T1505/001/](https://attack.mitre.org/techniques/T1505/001/)](https://attack.mitre.org/techniques/T1505/001/)

**Tags**:
- Domain: Network
- Use Case: Network Security Monitoring
- Use Case: Threat Detection
- Tactic: Persistence
- Data Source: Network Packet Capture
- Resources: Investigation Guide

**Version**: 1
**Rule authors**:
- Elastic

**Rule license**: Elastic License v2

## Setup

This rule requires the Elastic Network Packet Capture integration with the MySQL protocol analyzer enabled and
cleartext visibility into MySQL query traffic. TLS-encrypted sessions and incomplete or asymmetric capture can hide
query text. Use MySQL audit logs and endpoint telemetry for authoritative user attribution and proof of library
creation or command execution.

## Investigation guide


## Triage and analysis


### Investigating MySQL User-Defined Function Injection

MySQL can load native user-defined functions from shared libraries. Attackers who obtain the `FILE` privilege and write access to the plugin directory can write a malicious `.so` or `.dll`, register it with `CREATE FUNCTION ... SONAME`, and invoke operating-system commands as the MySQL service account.

### Possible investigation steps

- Review `client.ip`, `server.ip`, `network.community_id`, `network_traffic.mysql.query`, `network_traffic.mysql.path`, and any response error fields.
- Extract the function and library names and verify whether they belong to an approved MySQL extension.
- Search prior queries on the same connection for `INTO DUMPFILE`, `INTO OUTFILE`, `LOAD_FILE`, plugin-directory discovery, or hexadecimal payload construction.
- On the database host, inspect the MySQL plugin directory for newly created `.so`, `.dll`, or other unexpected files.
- Correlate with child processes spawned by `mysqld` and with outbound connections from the database host.


### False positive analysis

- Approved native UDF installation is uncommon but legitimate. Confirm the package source and change record.
- Do not exclude all DBA clients permanently; a compromised DBA workstation can perform the same operation.


### Response and remediation

- Terminate unauthorized database sessions and isolate the database host if command execution is suspected.
- Remove the malicious function and library only after preserving evidence.
- Rotate database credentials, review grants containing `FILE`, and restrict writes to the plugin directory.


## Rule Query

```eql
any where data_stream.dataset == "network_traffic.mysql" and
    network_traffic.mysql.query like~ "*create*function*soname*"
```

**Framework:** MITRE ATT&CK
- Tactic:
  - Name: Persistence
- Id: TA0003
- Reference URL: [[https://attack.mitre.org/tactics/TA0003/](https://attack.mitre.org/tactics/TA0003/)](https://attack.mitre.org/tactics/TA0003/)
- Technique:
  - Name: Server Software Component
- Id: T1505
- Reference URL: [[https://attack.mitre.org/techniques/T1505/](https://attack.mitre.org/techniques/T1505/)](https://attack.mitre.org/techniques/T1505/)
- Sub Technique:
  - Name: SQL Stored Procedures
- Id: T1505.001
- Reference URL: [[https://attack.mitre.org/techniques/T1505/001/](https://attack.mitre.org/techniques/T1505/001/)](https://attack.mitre.org/techniques/T1505/001/)