Sigma rule: SQL Injection Strings In URI

Rule

Title

SQL Injection Strings In URI

Status

test

Level

high

Author

Saw Win Naung, Nasreddine Bencherchali (Nextron Systems), Thurein Oo (Yoma Bank)

Date

2020-02-22

Modified

2023-09-04

File

rules/web/webserver_generic/web_sql_injection_in_access_logs.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects potential SQL injection attempts via GET requests in access logs.

Log source

category

webserver

Detection

selection:
    cs-method: 'GET'
keywords:
    - '@@version'
    - '%271%27%3D%271'
    - '=select '
    - '=select('
    - '=select%20'
    - 'concat_ws('
    - 'CONCAT(0x'
    - 'from mysql.innodb_table_stats'
    - 'from%20mysql.innodb_table_stats'
    - 'group_concat('
    - 'information_schema.tables'
    - 'json_arrayagg('
    - 'or 1=1#'
    - 'or%201=1#'
    - 'order by '
    - 'order%20by%20'
    - 'select * '
    - 'select database()'
    - 'select version()'
    - 'select%20*%20'
    - 'select%20database()'
    - 'select%20version()'
    - 'select%28sleep%2810%29'
    - 'SELECTCHAR('
    - 'table_schema'
    - 'UNION ALL SELECT'
    - 'UNION SELECT'
    - 'UNION%20ALL%20SELECT'
    - 'UNION%20SELECT'
    - "'1'='1"
filter_main_status:
    sc-status: 404
condition: selection and keywords and not 1 of filter_main_*

False positives (as the rule lists them)

• Java scripts and CSS Files
• User searches in search boxes of the respective website
• Internal vulnerability scanners can cause some serious FPs when used, if you experience a lot of FPs due to this think of adding more filters such as "User Agent" strings and more response codes

Tags

• attack.initial-access
• attack.t1190

MITRE ATT&CK ids this rule names

• T1190

References

• https://www.acunetix.com/blog/articles/exploiting-sql-injection-example/
• https://www.acunetix.com/blog/articles/using-logs-to-investigate-a-web-application-attack/
• https://brightsec.com/blog/sql-injection-payloads/
• https://github.com/payloadbox/sql-injection-payload-list
• https://book.hacktricks.xyz/pentesting-web/sql-injection/mysql-injection

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/web/webserver_generic/web_sql_injection_in_access_logs.yml