Uncommon File Creation By Mysql Daemon Process

Status: test
Severity: high
Log source: category file_event, product windows
Author: Joseph Kamau
Source: github.com/SigmaHQ/sigma

Detects the creation of files with scripting or executable extensions by Mysql daemon. Which could be an indicator of "User Defined Functions" abuse to download malware.

MITRE ATT&CK coverage

Tactic	Techniques
Stealth	No specific technique

Telemetry coverage

Provider	Record / event type
Sysmon	Event ID 11: FileCreate

Rule body

title: Uncommon File Creation By Mysql Daemon Process
id: c61daa90-3c1e-4f18-af62-8f288b5c9aaf
status: test
description: |
    Detects the creation of files with scripting or executable extensions by Mysql daemon.
    Which could be an indicator of "User Defined Functions" abuse to download malware.
references:
    - https://asec.ahnlab.com/en/58878/
    - https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/honeypot-recon-mysql-malware-infection-via-user-defined-functions-udf/
author: Joseph Kamau
date: 2024-05-27
tags:
    - attack.stealth
logsource:
    product: windows
    category: file_event
detection:
    selection:
        Image|endswith:
            - \mysqld.exe
            - \mysqld-nt.exe
        TargetFilename|endswith:
            - '.bat'
            - '.dat'
            - '.dll'
            - '.exe'
            - '.ps1'
            - '.psm1'
            - '.vbe'
            - '.vbs'
    condition: selection
falsepositives:
    - Unknown
level: high

Stages and Predicates

Stage 0: `condition`

selection

Stage 1: `selection`

selection:
    Image|endswith:
        - \mysqld.exe
        - \mysqld-nt.exe
    TargetFilename|endswith:
        - '.bat'
        - '.dat'
        - '.dll'
        - '.exe'
        - '.ps1'
        - '.psm1'
        - '.vbe'
        - '.vbs'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`Image`	ends_with	`\mysqld-nt.exe` `\mysqld.exe`	`field:"Image" kind:ends_with`
`TargetFilename`	ends_with	`.bat` corpus 17 (sigma 17) `.dat` corpus 4 (sigma 3, splunk 1) `.dll` corpus 24 (sigma 24) `.exe` corpus 21 (sigma 20, splunk 1) `.ps1` corpus 17 (sigma 17) `.psm1` corpus 4 (sigma 4) `.vbe` corpus 16 (sigma 16) `.vbs` corpus 18 (sigma 18)	`field:"TargetFilename" kind:ends_with`