mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
divious1
91 lines
3.8 KiB
JSON
91 lines
3.8 KiB
JSON
{
|
|
"asset_type": "Database Server",
|
|
"channel": "ESCU",
|
|
"confidence": "medium",
|
|
"correlation_rule": {
|
|
"notable": {
|
|
"nes_fields": "dest, src, url",
|
|
"rule_description": "Using the length of url or user agent to identify SQL injection",
|
|
"rule_title": "SQL Injection with Long URLs"
|
|
},
|
|
"risk": {
|
|
"risk_object": "dest",
|
|
"risk_object_type": [
|
|
"system"
|
|
],
|
|
"risk_score": 30
|
|
},
|
|
"suppress": {
|
|
"suppress_fields": "dest,src,url",
|
|
"suppress_period": "14400s"
|
|
}
|
|
},
|
|
"creation_date": "2016-09-13",
|
|
"data_metadata": {
|
|
"data_models": [
|
|
"Web"
|
|
],
|
|
"data_source": [
|
|
"Network Communication"
|
|
],
|
|
"providing_technologies": [
|
|
"Splunk Stream",
|
|
"Bro"
|
|
]
|
|
},
|
|
"eli5": "This search looks only at your web servers and returns the source, the web server, the URL and its length, and the user agent associated with HTTP GET requests for extremely long URLs or user agent lengths with more than three common SQL commands found within the URL.",
|
|
"how_to_implement": "To successfully implement this search, you need to be monitoring network communications to your web servers or ingesting your HTTP logs and populating the Web data model. You must also identify your web servers in the Enterprise Security assets table.",
|
|
"known_false_positives": "It's possible that legitimate traffic will have long URLs or long user agent strings and that common SQL commands may be found within the URL. Please investigate as appropriate.",
|
|
"maintainers": [
|
|
{
|
|
"company": "Splunk",
|
|
"email": "bpatel@splunk.com",
|
|
"name": "Bhavin Patel"
|
|
}
|
|
],
|
|
"mappings": {
|
|
"cis20": [
|
|
"CIS 4",
|
|
"CIS 13",
|
|
"CIS 18"
|
|
],
|
|
"kill_chain_phases": [
|
|
"Delivery"
|
|
],
|
|
"mitre_attack": [
|
|
"Defense Evasion",
|
|
"Exploitation of Vulnerability",
|
|
"Execution",
|
|
"Commonly Used Port"
|
|
],
|
|
"nist": [
|
|
"PR.DS",
|
|
"ID.RA",
|
|
"PR.PT",
|
|
"PR.IP",
|
|
"DE.CM"
|
|
]
|
|
},
|
|
"modification_date": "2017-09-19",
|
|
"original_authors": [
|
|
{
|
|
"company": "Splunk",
|
|
"email": "bpatel@splunk.com",
|
|
"name": "Bhavin Patel"
|
|
}
|
|
],
|
|
"scheduling": {
|
|
"cron_schedule": "0 * * * *",
|
|
"earliest_time": "-70m@m",
|
|
"latest_time": "-10m@m"
|
|
},
|
|
"search": "| tstats `summariesonly` count from datamodel=Web where Web.dest_category=web_server AND (Web.url_length > 1024 OR Web.http_user_agent_length > 200) by Web.src Web.dest Web.url Web.url_length Web.http_user_agent | `drop_dm_object_name(\"Web\")` | eval num_sql_cmds=mvcount(split(url, \"alter%20table\")) + mvcount(split(url, \"between\")) + mvcount(split(url, \"create%20table\")) + mvcount(split(url, \"create%20database\")) + mvcount(split(url, \"create%20index\")) + mvcount(split(url, \"create%20view\")) + mvcount(split(url, \"delete\")) + mvcount(split(url, \"drop%20database\")) + mvcount(split(url, \"drop%20index\")) + mvcount(split(url, \"drop%20table\")) + mvcount(split(url, \"exists\")) + mvcount(split(url, \"exec\")) + mvcount(split(url, \"group%20by\")) + mvcount(split(url, \"having\")) + mvcount(split(url, \"insert%20into\")) + mvcount(split(url, \"inner%20join\")) + mvcount(split(url, \"left%20join\")) + mvcount(split(url, \"right%20join\")) + mvcount(split(url, \"full%20join\")) + mvcount(split(url, \"select\")) + mvcount(split(url, \"distinct\")) + mvcount(split(url, \"select%20top\")) + mvcount(split(url, \"union\")) + mvcount(split(url, \"xp_cmdshell\")) - 24 | where num_sql_cmds > 3",
|
|
"search_description": "This search looks for long URLs that have several SQL commands visible within them.",
|
|
"search_id": "e0aad4cf-0790-423b-8328-7564d0d938f9",
|
|
"search_name": "SQL Injection with Long URLs",
|
|
"search_type": "detection",
|
|
"security_domain": "network",
|
|
"spec_version": 1,
|
|
"version": "1.0"
|
|
}
|