External Connection to Internet-Exposed Root MySQL Service (Port 3306)

Duo Tech@duotech

•updated Jul 8, 2026•1•0•5

This rule detects potentially unauthorized access or activity related to MySQL databases. It monitors for external network connections to the MySQL default port (3306) that originate from non-private IP addresses, and identifies suspicious process command lines using Python's PyMySQL library that attempt to authenticate as the 'root' user.