huntrule

Detect Potential SQL Injection Payloads in GET URIs via Webserver Access Logs

Flags HTTP GET URIs containing SQL injection indicator strings in webserver access logs, excluding 404 responses.

FreeReviewedSigma · High · v2
Category
webserver
Author
Saw Win Naung, Nasreddine Bencherchali (Nextron Systems), Thurein Oo (Yoma Bank) (SigmaHQ), DRL 1.1
Published
2020-02-22
Updated
2026-07-31
AnalysisDetection

ATT&CK techniques

Initial Access

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule flags HTTP GET requests where the requested URI contains common SQL injection string patterns and encoded payloads (e.g., UNION SELECT, OR 1=1, SELECT version/database, and time-delay function usage). Attackers use these payloads to probe for database query weaknesses and potentially extract or manipulate data. It relies on webserver access log fields for request method, URI content, and HTTP status, including the exclusion of a specific 404 status filter set.

Reporting behind it

Related detections9 linkedT1190 — drag to rearrange
Malicious Node.js Process Spawning Unix Shell or Network Client
Malicious SharePoint ToolShell Exploitation via ToolPane Endpoint
Malicious Exchange Mailbox Export to ASPX via New-MailboxExportRequest
Suspicious Shell Spawned by ActiveMQ Java Process
Cleo Autorun Exploitation via Healthcheck File Drop
Suspicious SharePoint Worker Process Spawning Command Interpreter via ToolShell
Malicious IIS Worker Process Spawning Command Shell Reconnaissance
Potential StyleSmuggler (CVE-2026-75650) Exploitation Attempt - Magento GraphQL Styles Parameter (via webserver)
Cisco IOS XE Configuration Change by Web UI WSMA User
Detect Potential SQL Injection Payloads in GET URIs via Webserver Access Logs
Pivot detection · T1190 · 9 related

Changelog

v2
  1. v2
    Candidate ingested via manual entry.2026-07-31
  2. v1
    No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.