mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
Eric McGinnis
22 lines
998 B
YAML
22 lines
998 B
YAML
name: SQL Injection
|
|
id: 4f6632f5-449c-4686-80df-57625f59bab3
|
|
version: 2
|
|
creation_date: '2019-10-16'
|
|
modification_date: '2026-05-13'
|
|
author: Bhavin Patel, Splunk
|
|
status: production
|
|
description: Use the searches in this Analytic Story to help you detect structured query language (SQL) injection attempts characterized by long URLs that contain malicious parameters.
|
|
narrative: 'It is very common for attackers to inject SQL parameters into vulnerable web applications, which then interpret the malicious SQL statements.
|
|
|
|
This Analytic Story contains a search designed to identify attempts by attackers to leverage this technique to compromise a host and gain a foothold in the target environment.'
|
|
references:
|
|
- https://capec.mitre.org/data/definitions/66.html
|
|
- https://www.incapsula.com/web-application-security/sql-injection.html
|
|
category:
|
|
- Adversary Tactics
|
|
product:
|
|
- Splunk Enterprise
|
|
- Splunk Enterprise Security
|
|
- Splunk Cloud
|
|
usecase: Advanced Threat Detection
|