Python SQL Exception Errors (PEP 249) Logged by Applications

title: Python SQL Exception Errors (PEP 249) Logged by Applications
id: c476ca35-5f9a-4a8a-b1c3-4c1a37c7d035
status: stable
description: "This rule flags application log events that contain common Python DB-API (PEP 249) exception class names: DataError, IntegrityError, ProgrammingError, or OperationalError. Attackers and automated tooling may trigger these SQL-related errors during probing, malformed queries, or unexpected database states as part of initial access or exploitation attempts. The detection relies on application log text containing the exception names corresponding to SQL execution or query handling failures."
references:
  - https://www.python.org/dev/peps/pep-0249/#exceptions
  - https://github.com/SigmaHQ/sigma/blob/master/rules/application/python/app_python_sql_exceptions.yml
author: Thomas Patzke, Huntrule Team
date: 2017-08-12
modified: 2020-09-01
tags:
  - attack.initial-access
  - attack.t1190
logsource:
  category: application
  product: python
detection:
  keywords:
    - DataError
    - IntegrityError
    - ProgrammingError
    - OperationalError
  condition: keywords
falsepositives:
  - Application bugs
level: medium
license: DRL-1.1
related:
  - id: 19aefed0-ffd4-47dc-a7fc-f8b1425e84f9
    type: derived