Database Data Manipulated via Remote SQL Query

Darshan Thummar@Mighty

•updated Jun 12, 2026•0•0•3

This rule detects attempts to manipulate database data on a remote MySQL server (port 3306) by identifying 'UPDATE' and 'SET' SQL commands within TCP traffic. It uses a threshold to alert on a high frequency of these commands from a single source, indicating potential malicious activity like data modification or integrity compromise.