Suspicious SQL Query (via database)

title: Suspicious SQL Query (via database)
id: 7edfb8b6-4687-56e9-b51d-e030b8b55298
status: stable
description: This rule detects anomalous SQL query keywrods that are frequently used during recon, exfiltration or destructive activities. Such as dropping tables and selecting wildcard fields
author: 'Huntrule Team'
date: 2026-07-21
references:
    - https://attack.mitre.org/techniques/T1505/001/
    - https://attack.mitre.org/techniques/T1190/
    - https://github.com/sqlmapproject/sqlmap
tags:
    - attack.exfiltration
    - attack.initial-access
    - attack.privilege-escalation
    - attack.persistence
    - attack.t1190
    - attack.t1505.001
logsource:
    category: database
    definition: 'Requirements: Must be able to log the SQL queries'
detection:
    keywords:
        - 'drop'
        - 'truncate'
        - 'dump'
        - 'select \*'
    condition: keywords
falsepositives:
    - Unknown
level: medium