Identifier / Programs / Linux and Unix
mysql
The MySQL tool. tldr-pages
GTFOBins library-load, shell 1 ATT&CK technique 2 documented commands
How mysql is abused
library-load
--default-authshell T1059.004 Command and Scripting Interpreter: Unix Shell
-eEach abuse is GTFOBins's category and the options and words it uses; the full write-up is on GTFOBins's page for mysql.
2 documented commands
library-load unprivileged, with sudo, as SUID
The following loads the /path/to/lib.so shared object.
mysql --default-auth ../../../../../path/to/libshell unprivileged, with sudo, as SUID
mysql -e '\! /bin/sh'None of the 2 commands the identifier reads trips a Sigma process-creation rule. These commands are, with GTFOBins’ notes, from GTFOBins, at commit acd524623f9c of 2026-05-27, under the GPL-3.0, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on GTFOBins’s page for mysql. The identifier reads the line of each that runs mysql.
What detects it
Everyday use
Connect to a database
mysql database_nameIdentifyConnect to a database, user will be prompted for a password
mysql --user user --password database_nameIdentifyConnect to a database on another host
mysql --host database_host database_nameIdentifyNone of the 3 examples the identifier reads matches GTFOBins abuse or trips a Sigma process-creation rule.