Python SQL Exception Errors Indicating Database Interaction Failures

Identifies Python application logs referencing common SQL exception classes from DB-API (PEP 249).

FreeReviewedSigma · Medium · v5

Product: python
Category: application
Author: Thomas Patzke (SigmaHQ), DRL 1.1
Published: 2017-08-12
Updated: 2026-07-31

ATT&CK techniques

Initial Access

Recon
Resource Dev
Initial Access
- T1190Exploit Public-Facing Application
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags application events from Python that include SQL-related exception class names tied to common database error categories: DataError, IntegrityError, ProgrammingError, and OperationalError. Attackers may intentionally trigger or probe database behavior to test inputs, validate states, or reach deeper application code paths. The detection relies on application telemetry that contains these exception keywords in the emitted log text.

Reporting behind it

Related detections9 linkedT1190 — drag to rearrange

Malicious Command Shell Spawned by SQL Server via Process Creation (via process_creation)

Malicious Command Shell or PowerShell Spawned by Tomcat via Process Creation (via process_creation)

Suspicious Shell Script Execution From Temp Directory on SonicWall SMA1000 Appliance (via process_creation)

Possible TP-Link Command Injection via WlanNetworkRpm Endpoint (via webserver)

Malicious SharePoint ToolPane Exploitation via SignOut Referer

Suspicious Tomcat Session Deserialization Trigger via Crafted JSESSIONID

Malicious Tomcat Partial PUT of Session File via Content-Range Header

Malicious Ivanti Connect Secure Path Traversal Exploitation of CVE-2024-21887

Malicious MOVEit moveitisapi Exploitation Request via webserver

Python SQL Exception Errors Indicating Database Interaction Failures

Pivot detection · T1190 · 9 related

Changelog

v5
Candidate ingested via manual entry.2026-07-31
v4
Candidate ingested via manual entry.2026-07-31
v3
Candidate ingested via manual entry.2026-07-31
v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

python-sql-exception-errors-pep-249-logged-by-applications-19aefed0

title: Python SQL Exception Errors Indicating Database Interaction Failures
id: c476ca35-5f9a-4a8a-b1c3-4c1a37c7d035
status: stable
description: "This rule flags application events from Python that include SQL-related exception class names tied to common database error categories: DataError, IntegrityError, ProgrammingError, and OperationalError. Attackers may intentionally trigger or probe database behavior to test inputs, validate states, or reach deeper application code paths. The detection relies on application telemetry that contains these exception keywords in the emitted log text."
references:
  - https://www.python.org/dev/peps/pep-0249/#exceptions
  - https://github.com/SigmaHQ/sigma/blob/master/rules/application/python/app_python_sql_exceptions.yml
author: Thomas Patzke, Huntrule Team
date: 2017-08-12
modified: 2020-09-01
tags:
  - attack.initial-access
  - attack.t1190
logsource:
  category: application
  product: python
detection:
  keywords:
    - DataError
    - IntegrityError
    - ProgrammingError
    - OperationalError
  condition: keywords
falsepositives:
  - Application bugs
level: medium
license: DRL-1.1
related:
  - id: 19aefed0-ffd4-47dc-a7fc-f8b1425e84f9
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL