mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
divious1
47 lines
1.6 KiB
JSON
47 lines
1.6 KiB
JSON
{
|
|
"category": "Adversary Tactics",
|
|
"channel": "ESCU",
|
|
"creation_date": "2016-09-13",
|
|
"description": "Use the searches in this Analytic Story to help you detect structured query language (SQL) injection attempts characterized by long URLs that contain malicious parameters.",
|
|
"id": "4f6632f5-449c-4686-80df-57625f59bab3",
|
|
"maintainers": [
|
|
{
|
|
"company": "Splunk",
|
|
"email": "bpatel@splunk.com",
|
|
"name": "Bhavin Patel"
|
|
}
|
|
],
|
|
"modification_date": "2017-09-19",
|
|
"name": "SQL Injection",
|
|
"narrative": "It is very common for attackers to inject SQL parameters into vulnerable web applications, which then interpret the malicious SQL statements.<br></br>This Analytic Story contains a search designed to identify attempts by attackers to leverage this technique to compromise a host and gain a foothold in the target environment.",
|
|
"original_authors": [
|
|
{
|
|
"company": "Splunk",
|
|
"email": "bpatel@splunk.com",
|
|
"name": "Bhavin Patel"
|
|
}
|
|
],
|
|
"references": [
|
|
"https://www.owasp.org/index.php/SQL_Injection",
|
|
"https://www.owasp.org/index.php/Blind_SQL_Injection",
|
|
"https://www.incapsula.com/web-application-security/sql-injection.html"
|
|
],
|
|
"searches": {
|
|
"contextual_searches": [
|
|
"Get Notable Info",
|
|
"Get Notable History",
|
|
"Get User Information from Identity Table",
|
|
"Get Authentication Logs For Endpoint",
|
|
"Get Risk Modifiers For User",
|
|
"Get Risk Modifiers For Endpoint"
|
|
],
|
|
"detection_searches": [
|
|
"SQL Injection with Long URLs"
|
|
],
|
|
"investigative_searches": [],
|
|
"support_searches": []
|
|
},
|
|
"spec_version": 1,
|
|
"version": "1.0"
|
|
}
|