← Back to SOC feed Coverage →

This rule checks MySQL database presence

yara LOW Yara-Rules
community
This rule was pulled from an open-source repository and enriched with AI. Validate in a test environment before deploying to production.
View original rule at Yara-Rules →
Retrieved: 2026-04-22T09:00:00Z · Confidence: medium

Hunt Hypothesis

Adversaries may attempt to establish a persistent presence in a MySQL database by creating or modifying database objects, which could be an early indicator of compromise. SOC teams should proactively hunt for this behavior to identify potential unauthorized database access or lateral movement in their Azure Sentinel environment.

YARA Rule

rule mysql_database_presence
{
    meta:
        author="CYB3RMX"
        description="This rule checks MySQL database presence"

    strings:
        $db = "MySql.Data"
        $db1 = "MySqlCommand"
        $db2 = "MySqlConnection"
        $db3 = "MySqlDataReader"
        $db4 = "MySql.Data.MySqlClient"

    condition:
        (any of ($db*))
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

This rule contains 5 string patterns in its detection logic.

False Positive Guidance

Original source: https://github.com/Yara-Rules/rules/blob/main/capabilities/capabilities.yar