Detection catalogue

Explore published rules with transparent provenance, licensing, and ATT&CK mappings.

detections

Loading detections…

Uncommon File Creation By Mysql Daemon Process

Detects the creation of files with scripting or executable extensions by Mysql daemon. Which could be an indicator of "User Defined Functions" abuse to download malware.

ATT&CK coverage

This detection is not mapped to any ATT&CK technique.

Detection requirements

Log source product: windows
Log source category: file_event

Detection logic

Published to signed-in readers

The query as its source wrote it, its canonical form, and the content hash that pins this exact revision.