MySQL mysql.func Table Query for UDF Privilege Escalation Probe

Duo Tech@duotech

•updated Jul 8, 2026•2•0•3

This rule detects the execution of Python or MySQL command-line utilities where the command line contains strings indicative of 'mysql.func'. This pattern is often associated with the loading of malicious UDFs (User Defined Functions) or other exploitation techniques targeting database environments through script interpreters.