rule:
  meta:
    name: reference SQL statements
    namespace: collection/database/sql
    author: william.ballenthin@fireeye.com
    scope: function
    att&ck:
      - Collection::Data from Information Repositories [T1213]
    examples:
      - 5F66B82558CA92E54E77F216EF4C066C:0x42B1DF
  features:
    - and:
      - string: /SELECT.*FROM.*WHERE/