MySQL User-Defined Function Injection

IMPORTANT: This documentation is no longer updated. Refer to Elastic's version policy and the latest documentation.

MySQL User-Defined Function Injection

Identifies MySQL statements that create a user-defined function backed by a shared library. Adversaries with sufficient database privileges can place a malicious library in the MySQL plugin directory and register it with "CREATE FUNCTION … SONAME", establishing a database-resident primitive for operating-system command execution.

Rule type: eql

Rule indices:

logs-network_traffic.mysql-*

Severity: high

Risk score: 73

Runs every: 5m

Searches indices from: now-9m (Date Math format, see also Additional look-back time)

Maximum alerts per execution: 100

References:

Tags:

Domain: Network
Use Case: Network Security Monitoring
Use Case: Threat Detection
Tactic: Persistence
Data Source: Network Packet Capture
Resources: Investigation Guide

Version: 1

Rule authors:

Elastic

Rule license: Elastic License v2

Investigation guide

edit

Triage and analysis

Investigating MySQL User-Defined Function Injection

MySQL can load native user-defined functions from shared libraries. Attackers who obtain the FILE privilege and write access to the plugin directory can write a malicious .so or .dll, register it with CREATE FUNCTION ... SONAME, and invoke operating-system commands as the MySQL service account.

Possible investigation steps

Review client.ip, server.ip, network.community_id, network_traffic.mysql.query, network_traffic.mysql.path, and any response error fields.
Extract the function and library names and verify whether they belong to an approved MySQL extension.
Search prior queries on the same connection for INTO DUMPFILE, INTO OUTFILE, LOAD_FILE, plugin-directory discovery, or hexadecimal payload construction.
On the database host, inspect the MySQL plugin directory for newly created .so, .dll, or other unexpected files.
Correlate with child processes spawned by mysqld and with outbound connections from the database host.

False positive analysis

Approved native UDF installation is uncommon but legitimate. Confirm the package source and change record.
Do not exclude all DBA clients permanently; a compromised DBA workstation can perform the same operation.

Response and remediation

Terminate unauthorized database sessions and isolate the database host if command execution is suspected.
Remove the malicious function and library only after preserving evidence.
Rotate database credentials, review grants containing FILE, and restrict writes to the plugin directory.

Setup

edit

Setup

This rule requires the Elastic Network Packet Capture integration with the MySQL protocol analyzer enabled and cleartext visibility into MySQL query traffic. TLS-encrypted sessions and incomplete or asymmetric capture can hide query text. Use MySQL audit logs and endpoint telemetry for authoritative user attribution and proof of library creation or command execution.

Rule query

edit

any where data_stream.dataset == "network_traffic.mysql" and
    network_traffic.mysql.query like~ "*create*function*soname*"

Framework: MITRE ATT&CK^TM

Tactic:
- Name: Persistence
- ID: TA0003
- Reference URL: https://attack.mitre.org/tactics/TA0003/
Technique:
- Name: Server Software Component
- ID: T1505
- Reference URL: https://attack.mitre.org/techniques/T1505/
Sub-technique:
- Name: SQL Stored Procedures
- ID: T1505.001
- Reference URL: https://attack.mitre.org/techniques/T1505/001/

« Thrift RPC Method from an External Client Potential EDR-Freeze via WerFaultSecure Abuse »