Suspicious SQL Query — Sigma Rule

Rule metadata and linked tags

Author: @juju4. Source status: test; severity: medium. Source dates: 2022-12-27 / not supplied.

{
  "category": "database",
  "definition": "Requirements: Must be able to log the SQL queries"
}

Pinned original Sigma rule · Detection Rule License 1.1

Source SHA-256: 00c3084249d5512cf982aca451f2ce87eed1ad491b8826656748020193fa59d1

Detection logic

Original source YAML. Source-tag agreement is not proof of complete semantic coverage. This rule has not been compiled for a SIEM backend or validated against live telemetry here.

title: Suspicious SQL Query
id: d84c0ded-edd7-4123-80ed-348bb3ccc4d5
status: test
description: Detects suspicious SQL query keywrods that are often used during recon, exfiltration or destructive activities. Such as dropping tables and selecting wildcard fields
author: '@juju4'
date: 2022-12-27
references:
    - https://github.com/sqlmapproject/sqlmap
tags:
    - attack.exfiltration
    - attack.initial-access
    - attack.privilege-escalation
    - attack.persistence
    - attack.t1190
    - attack.t1505.001
logsource:
    category: database
    definition: 'Requirements: Must be able to log the SQL queries'
detection:
    keywords:
        - 'drop'
        - 'truncate'
        - 'dump'
        - 'select \*'
    condition: keywords
falsepositives:
    - Inventory and monitoring activity
    - Vulnerability scanners
    - Legitimate applications
level: medium

Original YAML and metadata in JSON

False positives

• Inventory and monitoring activity
• Vulnerability scanners
• Legitimate applications

Source references

• https://github.com/sqlmapproject/sqlmap