Loading

MySQL User-Defined Function Injection

Identifies MySQL statements that create a user-defined function backed by a shared library. Adversaries with sufficient database privileges can place a malicious library in the MySQL plugin directory and register it with "CREATE FUNCTION ... SONAME", establishing a database-resident primitive for operating-system command execution.

Rule type: eql
Rule indices:

  • logs-network_traffic.mysql-*

Rule Severity: high
Risk Score: 73
Runs every:
Searches indices from: now-9m
Maximum alerts per execution: 100
References:

Tags:

  • Domain: Network
  • Use Case: Network Security Monitoring
  • Use Case: Threat Detection
  • Tactic: Persistence
  • Data Source: Network Packet Capture
  • Resources: Investigation Guide

Version: 1
Rule authors:

  • Elastic

Rule license: Elastic License v2

This rule requires the Elastic Network Packet Capture integration with the MySQL protocol analyzer enabled and cleartext visibility into MySQL query traffic. TLS-encrypted sessions and incomplete or asymmetric capture can hide query text. Use MySQL audit logs and endpoint telemetry for authoritative user attribution and proof of library creation or command execution.

MySQL can load native user-defined functions from shared libraries. Attackers who obtain the FILE privilege and write access to the plugin directory can write a malicious .so or .dll, register it with CREATE FUNCTION ... SONAME, and invoke operating-system commands as the MySQL service account.

  • Review client.ip, server.ip, network.community_id, network_traffic.mysql.query, network_traffic.mysql.path, and any response error fields.
  • Extract the function and library names and verify whether they belong to an approved MySQL extension.
  • Search prior queries on the same connection for INTO DUMPFILE, INTO OUTFILE, LOAD_FILE, plugin-directory discovery, or hexadecimal payload construction.
  • On the database host, inspect the MySQL plugin directory for newly created .so, .dll, or other unexpected files.
  • Correlate with child processes spawned by mysqld and with outbound connections from the database host.
  • Approved native UDF installation is uncommon but legitimate. Confirm the package source and change record.
  • Do not exclude all DBA clients permanently; a compromised DBA workstation can perform the same operation.
  • Terminate unauthorized database sessions and isolate the database host if command execution is suspected.
  • Remove the malicious function and library only after preserving evidence.
  • Rotate database credentials, review grants containing FILE, and restrict writes to the plugin directory.
any where data_stream.dataset == "network_traffic.mysql" and
    network_traffic.mysql.query like~ "*create*function*soname*"

Framework: MITRE ATT&CK