SQL Error Message Keywords Indicating Potential Injection Probing

title: SQL Error Message Keywords Indicating Potential Injection Probing
id: b08f4092-77ef-4691-a2e0-f29f5b1f199d
status: test
description: This rule flags application SQL error messages that contain specific database error text consistent with probing for SQL injection attempts. Attackers often use malformed input to trigger syntax or parsing errors and adjust their payloads based on the responses. It relies on collected SQL application error logs and matches error message keywords such as unterminated quoted strings, SQL syntax errors, and UNION column count mismatches.
references:
  - http://www.sqlinjection.net/errors
  - https://github.com/SigmaHQ/sigma/blob/master/rules/application/sql/app_sqlinjection_errors.yml
author: Bjoern Kimminich, Huntrule Team
date: 2017-11-27
modified: 2023-02-12
tags:
  - attack.initial-access
  - attack.t1190
logsource:
  category: application
  product: sql
  definition: "Requirements: application error logs must be collected (with LOG_LEVEL ERROR and above)"
detection:
  keywords:
    - quoted string not properly terminated
    - You have an error in your SQL syntax
    - Unclosed quotation mark
    - 'near "*": syntax error'
    - SELECTs to the left and right of UNION do not have the same number of result columns
  condition: keywords
falsepositives:
  - A syntax error in MySQL also occurs in non-dynamic (safe) queries if there is an empty in() clause, that may often be the case.
level: high
license: DRL-1.1
related:
  - id: 8a670c6d-7189-4b1c-8017-a417ca84a086
    type: derived