sigma-rules/rules/linux/execution_mysql_binary.toml

[metadata]
creation_date = "2022/03/09"
maturity = "production"
updated_date = "2022/03/31"

[rule]
author = ["Elastic"]
description = """
Identifies MySQL server abuse to break out from restricted environments by spawning an interactive system shell.The
MySQL is an open source relational database management system and the activity of spawning shell is not a standard use
of this binary for a user or system administrator.It indicates a potentially malicious actor attempting to improve the
capabilities or stability of their access.
"""
from = "now-9m"
index = ["logs-endpoint.events.*"]
language = "eql"
license = "Elastic License v2"
name = "Linux Restricted Shell Breakout via the mysql command"
references = ["https://gtfobins.github.io/gtfobins/mysql/"]
risk_score = 47
rule_id = "83b2c6e5-e0b2-42d7-8542-8f3af86a1acb"
severity = "medium"
tags = ["Elastic", "Host", "Linux", "Threat Detection", "Execution", "GTFOBins"]
timestamp_override = "event.ingested"
type = "eql"

query = '''
process where event.type == "start" and process.name in ("bash", "sh", "dash") and
  process.parent.name == "mysql" and process.parent.args == "-e" and
  process.parent.args : ("\\!*sh", "\\!*bash", "\\!*dash", "\\!*/bin/sh", "\\!*/bin/bash", "\\!*/bin/dash")
'''


[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"
[[rule.threat.technique.subtechnique]]
id = "T1059.004"
name = "Unix Shell"
reference = "https://attack.mitre.org/techniques/T1059/004/"



[rule.threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"