MySQL UDF Privilege-Escalation Probing via mysql.func Table Checks

Duo Tech@duotech

•updated Jul 8, 2026•3•0•11

This rule detects the use of database-related processes (mysql) or scripts (python) interacting with MySQL User-Defined Function (UDF) mechanisms. Attackers often abuse UDFs to execute arbitrary commands, load external libraries, or facilitate lateral movement/privilege escalation within a database environment.