LoFP / database administrators may install approved native mysql user-defined functions during planned maintenance. validate the function and library names, the client address, the maintenance window, and whether the shared library was supplied through an approved software deployment process.

Techniques

• T1505

Sample rules

MySQL User-Defined Function Injection

• source: elastic
• technicques:
  • T1505

Description

Identifies MySQL statements that create a user-defined function backed by a shared library. Adversaries with sufficient database privileges can place a malicious library in the MySQL plugin directory and register it with “CREATE FUNCTION … SONAME”, establishing a database-resident primitive for operating-system command execution.

Detection logic

any where data_stream.dataset == "network_traffic.mysql" and
    network_traffic.mysql.query like~ "*create*function*soname*"