Uncommon File Creation By MySQL Daemon Process

SigmaHQ Detections@sigmaHQ

•updated Apr 16, 2025•2•0•23

Detects the creation of files with scripting or executable extensions by the MySQL daemon process. This activity could indicate the abuse of MySQL User Defined Functions (UDFs) to download and execute malware, often as part of a broader compromise or to establish persistence.