MySQL AES_ENCRYPT Config Table Ransomware Encryption and DROP TABLE Destruction

Duo Tech@duotech

•updated Jul 8, 2026•1•0•1

Detects the execution of command lines containing suspicious keywords associated with potential data encryption, database table destruction, or configuration tampering. These commands, such as those invoking encryption functions or dropping configuration tables, are indicative of malicious activity often performed by ransomware or wiper malware to hinder system recovery or exfiltrate and destroy data.