mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
Patrick Bareiss
50 lines
2.2 KiB
YAML
50 lines
2.2 KiB
YAML
name: SQL Injection with Long URLs
|
|
id: e0aad4cf-0790-423b-8328-7564d0d938f9
|
|
version: 1
|
|
date: '2017-09-19'
|
|
description: This search looks for long URLs that have several SQL commands visible
|
|
within them.
|
|
how_to_implement: To successfully implement this search, you need to be monitoring
|
|
network communications to your web servers or ingesting your HTTP logs and populating
|
|
the Web data model. You must also identify your web servers in the Enterprise Security
|
|
assets table.
|
|
type: ESCU
|
|
references: []
|
|
author: Bhavin Patel, Splunk
|
|
search: '| tstats `security_content_summariesonly` count from datamodel=Web where
|
|
Web.dest_category=web_server AND (Web.url_length > 1024 OR Web.http_user_agent_length
|
|
> 200) by Web.src Web.dest Web.url Web.url_length Web.http_user_agent | `drop_dm_object_name("Web")`
|
|
| eval num_sql_cmds=mvcount(split(url, "alter%20table")) + mvcount(split(url, "between"))
|
|
+ mvcount(split(url, "create%20table")) + mvcount(split(url, "create%20database"))
|
|
+ mvcount(split(url, "create%20index")) + mvcount(split(url, "create%20view")) +
|
|
mvcount(split(url, "delete")) + mvcount(split(url, "drop%20database")) + mvcount(split(url,
|
|
"drop%20index")) + mvcount(split(url, "drop%20table")) + mvcount(split(url, "exists"))
|
|
+ mvcount(split(url, "exec")) + mvcount(split(url, "group%20by")) + mvcount(split(url,
|
|
"having")) + mvcount(split(url, "insert%20into")) + mvcount(split(url, "inner%20join"))
|
|
+ mvcount(split(url, "left%20join")) + mvcount(split(url, "right%20join")) + mvcount(split(url,
|
|
"full%20join")) + mvcount(split(url, "select")) + mvcount(split(url, "distinct"))
|
|
+ mvcount(split(url, "select%20top")) + mvcount(split(url, "union")) + mvcount(split(url,
|
|
"xp_cmdshell")) - 24 | where num_sql_cmds > 3 | `sql_injection_with_long_urls_filter`'
|
|
known_false_positives: It's possible that legitimate traffic will have long URLs or
|
|
long user agent strings and that common SQL commands may be found within the URL.
|
|
Please investigate as appropriate.
|
|
tags:
|
|
analytics_story:
|
|
- SQL Injection
|
|
mitre_attack_id:
|
|
- T1043
|
|
kill_chain_phases:
|
|
- Delivery
|
|
cis20:
|
|
- CIS 4
|
|
- CIS 13
|
|
- CIS 18
|
|
nist:
|
|
- PR.DS
|
|
- ID.RA
|
|
- PR.PT
|
|
- PR.IP
|
|
- DE.CM
|
|
security_domain: network
|
|
asset_type: Database Server
|