{
  "category": [
    "Adversary Tactics"
  ],
  "channel": "ESCU",
  "creation_date": "2016-09-13",
  "description": "Use the searches in this Analytic Story to help you detect structured query language (SQL) injection attempts characterized by long URLs that contain malicious parameters.",
  "detections": [
    {
      "detection_id": "e0aad4cf-0790-423b-8328-7564d0d938f9",
      "name": "SQL Injection with Long URLs",
      "type": "splunk"
    }
  ],
  "id": "4f6632f5-449c-4686-80df-57625f59bab3",
  "maintainers": [
    {
      "company": "Splunk",
      "email": "bpatel@splunk.com",
      "name": "Bhavin Patel"
    }
  ],
  "modification_date": "2017-09-19",
  "name": "SQL Injection",
  "narrative": "It is very common for attackers to inject SQL parameters into vulnerable web applications, which then interpret the malicious SQL statements.\\\nThis Analytic Story contains a search designed to identify attempts by attackers to leverage this technique to compromise a host and gain a foothold in the target environment.",
  "original_authors": [
    {
      "company": "Splunk",
      "email": "bpatel@splunk.com",
      "name": "Bhavin Patel"
    }
  ],
  "references": [
    "https://www.owasp.org/index.php/SQL_Injection",
    "https://www.owasp.org/index.php/Blind_SQL_Injection",
    "https://www.incapsula.com/web-application-security/sql-injection.html"
  ],
  "spec_version": 2,
  "usecase": "Advanced Threat Detection",
  "version": "1.0"
}