Detects attempts to load a native MySQL user-defined function (UDF) backed by a shared library by monitoring MySQL statements that register the UDF via CREATE FUNCTION ... SONAME. If an attacker gains FILE privilege and write access to the MySQL plugin directory, they can place a malicious shared library (.so/.dll), register it as a UDF, and cause the MySQL service account to execute operating-system commands. The rule analyzes network traffic for MySQL queries and flags patterns like CREATE FUNCTION ... SONAME within the network_traffic.mysql dataset, enabling detection of database-server-resident primitives used for command execution or persistence. Because TLS-encrypted sessions or incomplete captures can conceal query text, it is recommended to corroborate findings with MySQL audit logs and endpoint telemetry for attribution and evidence of library creation. The rule links to MITRE ATT&CK T1505 (Server Software Component) and subtechnique T1505.001 (SQL Stored Procedures) under the Persistence tactic. Severity is high, reflecting the potential impact of remote command execution through a compromised UDF, though legitimate DBAs may perform approved UDF deployments during maintenance."