diff --git a/capabilities/capabilities.yar b/capabilities/capabilities.yar index 98d5991..1f47a1f 100644 --- a/capabilities/capabilities.yar +++ b/capabilities/capabilities.yar @@ -912,3 +912,20 @@ rule ldpreload condition: ($a or $b) and 5 of them } + +rule mysql_database_presence +{ + meta: + author="CYB3RMX" + description="This rule checks MySQL database presence" + + strings: + $db = "MySql.Data" + $db1 = "MySqlCommand" + $db2 = "MySqlConnection" + $db3 = "MySqlDataReader" + $db4 = "MySql.Data.MySqlClient" + + condition: + (any of ($db*)) +}