MySQL Database DROP TABLE Attack

Darshan Thummar@Mighty

•updated Jun 10, 2026•0•0•4

This rule detects attempts to drop tables in a MySQL database. It specifically looks for the 'DROP TABLE' string in TCP traffic directed to the standard MySQL port (3306) on the home network. This activity is often indicative of malicious intent, such as data destruction or database tampering.