Our database has been breached. Though we changed the MySQL database user credentials, even moved to a new database, changed the server user credentials, CPanel, and FTP user credentials, and hardened the security, still the data gets breached time and again.
It seems like a trojan / malware hidden inside the system files. We tried almost everything (complete malware / virus scan, applied the security patches to our application, enabling MySQL logs) from our end as well as from the hosting provider, but still the malware was not found.
What we've found so far is,
The malicious program doesn't use the application to breach our database. Because if it uses the application it'll be logged as well, as it doesn't use the MySQL user which the application uses to interact and manage the data.
It changes only the specific database entities and adds redundant information to the tables.
We have enabled the MySQL General Query log to log all the queries (though we need to log only data manipulation queries), and through this we can find only the queries and their timestamps, not having the other crucial details like MySQL user which executes the query and how the user got connected to the database.
1. Can the MySQL / MariaDB security experts help us to find which MySQL user ran which query, through some log or even database insert before/after or update before/after triggers will help?
2. Is there any way to monitor MySQL processes to check which system process triggered the MySQL Daemon to execute the query, or in other words how the MySQL user connects to the database?