MySQL User-Defined Function Injection

 1[metadata]
 2creation_date = "2026/07/30"
 3integration = ["network_traffic"]
 4maturity = "production"
 5updated_date = "2026/07/30"
 6
 7[rule]
 8author = ["Elastic"]
 9description = """
10Identifies MySQL statements that create a user-defined function backed by a shared library. Adversaries with sufficient
11database privileges can place a malicious library in the MySQL plugin directory and register it with "CREATE FUNCTION
12... SONAME", establishing a database-resident primitive for operating-system command execution.
13"""
14false_positives = [
15    """
16    Database administrators may install approved native MySQL user-defined functions during planned maintenance.
17    Validate the function and library names, the client address, the maintenance window, and whether the shared library
18    was supplied through an approved software deployment process.
19    """,
20]
21from = "now-9m"
22index = ["logs-network_traffic.mysql-*"]
23language = "eql"
24license = "Elastic License v2"
25name = "MySQL User-Defined Function Injection"
26note = """## Triage and analysis
27
28### Investigating MySQL User-Defined Function Injection
29
30MySQL can load native user-defined functions from shared libraries. Attackers who obtain the `FILE` privilege and write access to the plugin directory can write a malicious `.so` or `.dll`, register it with `CREATE FUNCTION ... SONAME`, and invoke operating-system commands as the MySQL service account.
31
32### Possible investigation steps
33
34- Review `client.ip`, `server.ip`, `network.community_id`, `network_traffic.mysql.query`, `network_traffic.mysql.path`, and any response error fields.
35- Extract the function and library names and verify whether they belong to an approved MySQL extension.
36- Search prior queries on the same connection for `INTO DUMPFILE`, `INTO OUTFILE`, `LOAD_FILE`, plugin-directory discovery, or hexadecimal payload construction.
37- On the database host, inspect the MySQL plugin directory for newly created `.so`, `.dll`, or other unexpected files.
38- Correlate with child processes spawned by `mysqld` and with outbound connections from the database host.
39
40### False positive analysis
41
42- Approved native UDF installation is uncommon but legitimate. Confirm the package source and change record.
43- Do not exclude all DBA clients permanently; a compromised DBA workstation can perform the same operation.
44
45### Response and remediation
46
47- Terminate unauthorized database sessions and isolate the database host if command execution is suspected.
48- Remove the malicious function and library only after preserving evidence.
49- Rotate database credentials, review grants containing `FILE`, and restrict writes to the plugin directory.
50"""
51references = [
52    "https://legalhackers.com/advisories/MySQL-Exploit-Remote-Root-Code-Execution-Privesc-CVE-2016-6662.html",
53    "https://attack.mitre.org/techniques/T1505/001/",
54]
55risk_score = 73
56rule_id = "c375532d-069d-41e0-af70-8ca032eb58f5"
57setup = """## Setup
58
59This rule requires the Elastic Network Packet Capture integration with the MySQL protocol analyzer enabled and
60cleartext visibility into MySQL query traffic. TLS-encrypted sessions and incomplete or asymmetric capture can hide
61query text. Use MySQL audit logs and endpoint telemetry for authoritative user attribution and proof of library
62creation or command execution.
63"""
64severity = "high"
65tags = [
66    "Domain: Network",
67    "Use Case: Network Security Monitoring",
68    "Use Case: Threat Detection",
69    "Tactic: Persistence",
70    "Data Source: Network Packet Capture",
71    "Resources: Investigation Guide",
72]
73timestamp_override = "event.ingested"
74type = "eql"
75
76query = '''
77any where data_stream.dataset == "network_traffic.mysql" and
78    network_traffic.mysql.query like~ "*create*function*soname*"
79'''
80
81
82[[rule.threat]]
83framework = "MITRE ATT&CK"
84[[rule.threat.technique]]
85id = "T1505"
86name = "Server Software Component"
87reference = "https://attack.mitre.org/techniques/T1505/"
88[[rule.threat.technique.subtechnique]]
89id = "T1505.001"
90name = "SQL Stored Procedures"
91reference = "https://attack.mitre.org/techniques/T1505/001/"
92
93
94
95[rule.threat.tactic]
96id = "TA0003"
97name = "Persistence"
98reference = "https://attack.mitre.org/tactics/TA0003/"