Windows: Unusual File Creation by mysqld.exe with Script/Executable Extensions

title: "Windows: Unusual File Creation by mysqld.exe with Script/Executable Extensions"
id: c6aa2e77-836d-4494-a72c-bb1080e8c415
status: test
description: This rule flags file creation events where the creating process is mysqld.exe or mysqld-nt.exe and the target filename ends with common script or executable extensions (.bat, .dat, .dll, .exe, .ps1, .psm1, .vbe, .vbs). Attackers can abuse MySQL’s functionality to drop or stage malicious payloads, so file creation by a database daemon followed by executable/script artifacts is suspicious. The detection relies on Windows file event telemetry that records the process image path and the created target filename.
references:
  - https://asec.ahnlab.com/en/58878/
  - https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/honeypot-recon-mysql-malware-infection-via-user-defined-functions-udf/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_mysqld_uncommon_file_creation.yml
author: Joseph Kamau, Huntrule Team
date: 2024-05-27
tags:
  - attack.stealth
logsource:
  product: windows
  category: file_event
detection:
  selection:
    Image|endswith:
      - \mysqld.exe
      - \mysqld-nt.exe
    TargetFilename|endswith:
      - .bat
      - .dat
      - .dll
      - .exe
      - .ps1
      - .psm1
      - .vbe
      - .vbs
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: c61daa90-3c1e-4f18-af62-8f288b5c9aaf
    type: derived