Signature Detail

DB: MySQL "root" User Login

This signature detects login to a MySQL database as user "root." Some malware can be attempting to brute-force the root user password to gain access to the database, or an administrator can be performing database maintenance.

Extended Description

If an attempt to access a MySQL database remotely using the "root" account is detected, this could indicate an attack, like password-guessing, is underway.