Suspicious SQL Keyword Matching (DROP/TRUNCATE/DUMP/SELECT *)

Alerts on SQL queries containing DROP, TRUNCATE, DUMP, or SELECT * indicative of potentially malicious database activity.

FreeUnreviewedSigmamediumv1

suspicious-sql-keyword-matching-drop-truncate-dump-select-d84c0ded

title: Suspicious SQL Keyword Matching (DROP/TRUNCATE/DUMP/SELECT *)
id: 389a734e-3ea0-433f-a20a-47e030b63e56
status: test
description: This rule flags database activity containing common SQL keywords associated with reconnaissance, data extraction, or destructive actions. Attackers may use statements such as DROP/TRUNCATE/DUMP or broad SELECT * queries to enumerate schema, exfiltrate data, or impact availability. Detection relies on telemetry that records the executed SQL query text so the listed keywords can be matched.
author: "@juju4, Huntrule Team"
date: 2022-12-27
references:
  - https://github.com/sqlmapproject/sqlmap
  - https://github.com/SigmaHQ/sigma/blob/master/rules/category/database/db_anomalous_query.yml
tags:
  - attack.exfiltration
  - attack.initial-access
  - attack.privilege-escalation
  - attack.persistence
  - attack.t1190
  - attack.t1505.001
logsource:
  category: database
  definition: "Requirements: Must be able to log the SQL queries"
detection:
  keywords:
    - drop
    - truncate
    - dump
    - select \*
  condition: keywords
falsepositives:
  - Inventory and monitoring activity
  - Vulnerability scanners
  - Legitimate applications
level: medium
license: DRL-1.1
related:
  - id: d84c0ded-edd7-4123-80ed-348bb3ccc4d5
    type: derived

What it detects

This rule flags database activity containing common SQL keywords associated with reconnaissance, data extraction, or destructive actions. Attackers may use statements such as DROP/TRUNCATE/DUMP or broad SELECT * queries to enumerate schema, exfiltrate data, or impact availability. Detection relies on telemetry that records the executed SQL query text so the listed keywords can be matched.

Known false positives

Inventory and monitoring activity
Vulnerability scanners
Legitimate applications

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.