MySQL Stored Data Modified for Impact

Darshan Thummar@Mighty

•updated Jun 12, 2026•0•0•1

This rule detects attempts to modify stored data within a MySQL database, specifically looking for 'UPDATE' and 'WHERE' clauses in TCP traffic directed to the MySQL default port (3306). It triggers an alert if 50 such events are observed from the same source IP within a 30-second window, indicating potential malicious activity aimed at data integrity compromise.