Merge pull request #417 from CYB3RMX/patch-1

Added msql database usage checker

capabilities/capabilities.yar

@@ -912,3 +912,20 @@ rule ldpreload
 	condition:
 		($a or $b) and 5 of them
 }
+
+rule mysql_database_presence
+{
+    meta:
+        author="CYB3RMX"
+        description="This rule checks MySQL database presence"
+
+    strings:
+        $db = "MySql.Data"
+        $db1 = "MySqlCommand"
+        $db2 = "MySqlConnection"
+        $db3 = "MySqlDataReader"
+        $db4 = "MySql.Data.MySqlClient"
+
+    condition:
+        (any of ($db*))
+}