{"id":"d84c0ded-edd7-4123-80ed-348bb3ccc4d5","title":"Suspicious SQL Query","description":"Detects suspicious SQL query keywrods that are often used during recon, exfiltration or destructive activities. Such as dropping tables and selecting wildcard fields","author":"@juju4","status":"test","level":"medium","date":"2022-12-27","modified":"","tags":["attack.exfiltration","attack.initial-access","attack.privilege-escalation","attack.persistence","attack.t1190","attack.t1505.001"],"technique_ids":["T1190","T1505.001"],"logsource":{"category":"database","definition":"Requirements: Must be able to log the SQL queries"},"falsepositives":["Inventory and monitoring activity","Vulnerability scanners","Legitimate applications"],"references":["https://github.com/sqlmapproject/sqlmap"],"source_path":"rules/category/database/db_anomalous_query.yml","source_sha256":"00c3084249d5512cf982aca451f2ce87eed1ad491b8826656748020193fa59d1","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/category/database/db_anomalous_query.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Suspicious SQL Query\nid: d84c0ded-edd7-4123-80ed-348bb3ccc4d5\nstatus: test\ndescription: Detects suspicious SQL query keywrods that are often used during recon, exfiltration or destructive activities. Such as dropping tables and selecting wildcard fields\nauthor: '@juju4'\ndate: 2022-12-27\nreferences:\n    - https://github.com/sqlmapproject/sqlmap\ntags:\n    - attack.exfiltration\n    - attack.initial-access\n    - attack.privilege-escalation\n    - attack.persistence\n    - attack.t1190\n    - attack.t1505.001\nlogsource:\n    category: database\n    definition: 'Requirements: Must be able to log the SQL queries'\ndetection:\n    keywords:\n        - 'drop'\n        - 'truncate'\n        - 'dump'\n        - 'select \\*'\n    condition: keywords\nfalsepositives:\n    - Inventory and monitoring activity\n    - Vulnerability scanners\n    - Legitimate applications\nlevel: medium\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1190","id":"T1190","name":"Exploit Public-Facing Application","page":"techniques/enterprise/T1190/"},{"key":"enterprise/T1505.001","id":"T1505.001","name":"SQL Stored Procedures","page":"techniques/enterprise/T1505.001/"}],"data_path":"data/detection-rules/d84c0ded-edd7-4123-80ed-348bb3ccc4d5.json","kind":"sigma"}