Suspicious Python SQL Exceptions (via application)

This rule detects generic rule for SQL exceptions in Python according to PEP 249

Sigmamediumv1

sigma

suspicious-python-sql-exceptions-via-application

title: Suspicious Python SQL Exceptions (via application)
id: 26cf8b24-1f86-5280-8633-6206edf518a7
status: stable
description: This rule detects generic rule for SQL exceptions in Python according to PEP 249
references:
    - https://attack.mitre.org/techniques/T1190/
    - https://www.python.org/dev/peps/pep-0249/#exceptions
author: Huntrule Team
date: 2026-05-07
tags:
    - attack.initial-access
    - attack.t1190
logsource:
    category: application
    product: python
detection:
    keywords:
        - DataError
        - IntegrityError
        - ProgrammingError
        - OperationalError
    condition: keywords
falsepositives:
    - Unknown
level: medium

Known false positives

Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.