MySQL User-Defined Function Injection

Last updated 3 days ago on 2026-07-30

Created 3 days ago on 2026-07-30

About

Identifies MySQL statements that create a user-defined function backed by a shared library. Adversaries with sufficient database privileges can place a malicious library in the MySQL plugin directory and register it with "CREATE FUNCTION ... SONAME", establishing a database-resident primitive for operating-system command execution.

Tags

Domain: NetworkUse Case: Network Security MonitoringUse Case: Threat DetectionTactic: PersistenceData Source: Network Packet CaptureLanguage: eql

Severity

high

Risk Score

MITRE ATT&CK™

Persistence (TA0003)(external, opens in a new tab or window)

↳ Server Software Component (T1505)(external, opens in a new tab or window)

False Positive Examples

Database administrators may install approved native MySQL user-defined functions during planned maintenance. Validate the function and library names, the client address, the maintenance window, and whether the shared library was supplied through an approved software deployment process.

License

Elastic License v2(external, opens in a new tab or window)

Definition

Rule Type: Event Correlation Rule
Integration Pack: Prebuilt Security Detection Rules
Index Patterns: logs-network_traffic.mysql-*
Related Integrations: network_traffic(external, opens in a new tab or window)
Query

✄𐘗text code block:
✄𐘗any where data_stream.dataset == "network_traffic.mysql" and
    network_traffic.mysql.query like~ "*create*function*soname*"

Install detection rules in Elastic Security

Detect MySQL User-Defined Function Injection in the Elastic Security detection engine by installing this rule into your Elastic Stack.

To setup this rule, check out the installation guide for Prebuilt Security Detection Rules(external, opens in a new tab or window).