mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
Nasreddine Bencherchali
11c909f725
* Add YAML formatting and validation infrastructure - Add yamlfmt configuration (.yamlfmt) with 4-space indent, LF line endings - Add yamllint configuration (.yamllint) for syntax validation (detections/ only) - Add pre-commit hook for automatic YAML formatting - Add CI validation script with unified error output - Add GitHub Actions workflow for PR validation - Add documentation for setup and usage - Support custom yamlfmt binary path via --yamlfmt-path flag * comment yaml check from pre-commit * apply yamlfmt * Update yaml-validation.yml * Update yaml-validation.yml * application folder search formatting * cloud folder search formatting * web folder search formatting * network folder search formatting * endpoint folder search formatting * resolve first conflict * apply formatting * remove additional pipe * Update README.md * update versions * restore and update formatting (#3920) --------- Co-authored-by: Bhavin Patel <bhavin.j.patel91@gmail.com>
46 lines
3.1 KiB
YAML
46 lines
3.1 KiB
YAML
name: SQL Injection with Long URLs
|
|
id: e0aad4cf-0790-423b-8328-7564d0d938f9
|
|
version: 9
|
|
date: '2026-02-25'
|
|
author: Bhavin Patel, Splunk
|
|
status: experimental
|
|
type: TTP
|
|
description: The following analytic detects long URLs containing multiple SQL commands, indicating a potential SQL injection attack. This detection leverages web traffic data, specifically targeting web server destinations with URLs longer than 1024 characters or HTTP user agents longer than 200 characters. SQL injection is significant as it allows attackers to manipulate a web application's database, potentially leading to unauthorized data access or modification. If confirmed malicious, this activity could result in data breaches, unauthorized access, and complete system compromise. Immediate investigation and validation of alerts are crucial to mitigate these risks.
|
|
data_source: []
|
|
search: |-
|
|
| tstats `security_content_summariesonly` count FROM datamodel=Web
|
|
WHERE Web.dest_category=web_server
|
|
AND
|
|
(Web.url_length > 1024
|
|
OR
|
|
Web.http_user_agent_length > 200)
|
|
BY Web.src Web.dest Web.url
|
|
Web.url_length Web.http_user_agent
|
|
| `drop_dm_object_name("Web")`
|
|
| eval url=lower(url)
|
|
| eval num_sql_cmds=mvcount(split(url, "alter%20table")) + mvcount(split(url, "between")) + mvcount(split(url, "create%20table")) + mvcount(split(url, "create%20database")) + mvcount(split(url, "create%20index")) + mvcount(split(url, "create%20view")) + mvcount(split(url, "delete")) + mvcount(split(url, "drop%20database")) + mvcount(split(url, "drop%20index")) + mvcount(split(url, "drop%20table")) + mvcount(split(url, "exists")) + mvcount(split(url, "exec")) + mvcount(split(url, "group%20by")) + mvcount(split(url, "having")) + mvcount(split(url, "insert%20into")) + mvcount(split(url, "inner%20join")) + mvcount(split(url, "left%20join")) + mvcount(split(url, "right%20join")) + mvcount(split(url, "full%20join")) + mvcount(split(url, "select")) + mvcount(split(url, "distinct")) + mvcount(split(url, "select%20top")) + mvcount(split(url, "union")) + mvcount(split(url, "xp_cmdshell")) - 24
|
|
| where num_sql_cmds > 3
|
|
| `sql_injection_with_long_urls_filter`
|
|
how_to_implement: To successfully implement this search, you need to be monitoring network communications to your web servers or ingesting your HTTP logs and populating the Web data model. You must also identify your web servers in the Enterprise Security assets table.
|
|
known_false_positives: It's possible that legitimate traffic will have long URLs or long user agent strings and that common SQL commands may be found within the URL. Please investigate as appropriate.
|
|
references: []
|
|
rba:
|
|
message: SQL injection attempt with url $url$ detected on $dest$
|
|
risk_objects:
|
|
- field: dest
|
|
type: system
|
|
score: 25
|
|
threat_objects: []
|
|
tags:
|
|
analytic_story:
|
|
- SQL Injection
|
|
- GhostRedirector IIS Module and Rungan Backdoor
|
|
asset_type: Database Server
|
|
mitre_attack_id:
|
|
- T1190
|
|
product:
|
|
- Splunk Enterprise
|
|
- Splunk Enterprise Security
|
|
- Splunk Cloud
|
|
security_domain: network
|