Windows: File Creation by mysqld.exe With Script/Executable Extensions
Alerts on file creation by mysqld.exe producing .bat/.exe/.ps1/.vbs and other executable or script file types on Windows.
FreeReviewedSigma · High · v2
- Product
- windows
- Category
- file_event
- Author
- Joseph Kamau (SigmaHQ), DRL 1.1
- Published
- 2024-05-27
- Updated
- 2026-07-31
What it detects
This rule flags file creation events where the process image is mysqld.exe or mysqld-nt.exe and the created filename ends with common script or executable extensions. Attackers may abuse MySQL’s ability to write files (for example, via user-defined functions) to stage or execute malicious payloads. The detection relies on Windows file creation telemetry that includes the creating process path and the target filename.
Reporting behind it
- asec.ahnlab.comhttps://asec.ahnlab.com/en/58878/
- trustwave.comhttps://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/honeypot-recon-mysql-malware-infection-via-user-defined-functions-udf/
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_mysqld_uncommon_file_creation.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
windows-unusual-file-creation-by-mysqld-exe-with-script-executable-extensions-c61daa90
title: "Windows: File Creation by mysqld.exe With Script/Executable Extensions"
id: c6aa2e77-836d-4494-a72c-bb1080e8c415
status: test
description: This rule flags file creation events where the process image is mysqld.exe or mysqld-nt.exe and the created filename ends with common script or executable extensions. Attackers may abuse MySQL’s ability to write files (for example, via user-defined functions) to stage or execute malicious payloads. The detection relies on Windows file creation telemetry that includes the creating process path and the target filename.
references:
- https://asec.ahnlab.com/en/58878/
- https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/honeypot-recon-mysql-malware-infection-via-user-defined-functions-udf/
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_mysqld_uncommon_file_creation.yml
author: Joseph Kamau, Huntrule Team
date: 2024-05-27
tags:
- attack.stealth
logsource:
product: windows
category: file_event
detection:
selection:
Image|endswith:
- \mysqld.exe
- \mysqld-nt.exe
TargetFilename|endswith:
- .bat
- .dat
- .dll
- .exe
- .ps1
- .psm1
- .vbe
- .vbs
condition: selection
falsepositives:
- Unknown
level: high
license: DRL-1.1
related:
- id: c61daa90-3c1e-4f18-af62-8f288b5c9aaf
type: derived