Suspicious SQL Error Messages — Sigma Rule

Rule metadata and linked tags

Author: Bjoern Kimminich. Source status: test; severity: high. Source dates: 2017-11-27 / 2023-02-12.

{
  "category": "application",
  "product": "sql",
  "definition": "Requirements: application error logs must be collected (with LOG_LEVEL ERROR and above)"
}

Pinned original Sigma rule · Detection Rule License 1.1

Source SHA-256: 7da50bed07c353d94ba2364f17e805b9c937b24b72e1f7b6a232be27c7e2c0f5

Detection logic

Original source YAML. Source-tag agreement is not proof of complete semantic coverage. This rule has not been compiled for a SIEM backend or validated against live telemetry here.

title: Suspicious SQL Error Messages
id: 8a670c6d-7189-4b1c-8017-a417ca84a086
status: test
description: Detects SQL error messages that indicate probing for an injection attack
references:
    - http://www.sqlinjection.net/errors
author: Bjoern Kimminich
date: 2017-11-27
modified: 2023-02-12
tags:
    - attack.initial-access
    - attack.t1190
logsource:
    category: application
    product: sql
    definition: 'Requirements: application error logs must be collected (with LOG_LEVEL ERROR and above)'
detection:
    keywords:
        # Oracle
        - quoted string not properly terminated
        # MySQL
        - You have an error in your SQL syntax
        # SQL Server
        - Unclosed quotation mark
        # SQLite
        - 'near "*": syntax error'
        - SELECTs to the left and right of UNION do not have the same number of result columns
    condition: keywords
falsepositives:
    - A syntax error in MySQL also occurs in non-dynamic (safe) queries if there is an empty in() clause, that may often be the case.
level: high

Original YAML and metadata in JSON

False positives

• A syntax error in MySQL also occurs in non-dynamic (safe) queries if there is an empty in() clause, that may often be the case.

Source references

• http://www.sqlinjection.net/errors