mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
divious1
108 lines
3.9 KiB
YAML
108 lines
3.9 KiB
YAML
asset_type: Database Server
|
|
confidence: medium
|
|
creation_date: '2016-09-13'
|
|
data_metadata:
|
|
data_models:
|
|
- Web
|
|
data_source:
|
|
- Network Communication
|
|
providing_technologies:
|
|
- Splunk Stream
|
|
- Bro
|
|
description: This search looks for long URLs that have several SQL commands visible
|
|
within them.
|
|
detect:
|
|
splunk:
|
|
correlation_rule:
|
|
notable:
|
|
nes_fields: dest, src, url
|
|
rule_description: Using the length of url or user agent to identify SQL injection
|
|
rule_title: SQL Injection with Long URLs
|
|
risk:
|
|
risk_object: dest
|
|
risk_object_type:
|
|
- system
|
|
risk_score: 30
|
|
schedule:
|
|
cron_schedule: 0 * * * *
|
|
earliest_time: -70m@m
|
|
latest_time: -10m@m
|
|
search: '| tstats `security_content_summariesonly` count from datamodel=Web where Web.dest_category=web_server
|
|
AND (Web.url_length > 1024 OR Web.http_user_agent_length > 200) by Web.src
|
|
Web.dest Web.url Web.url_length Web.http_user_agent | `drop_dm_object_name("Web")`
|
|
| eval num_sql_cmds=mvcount(split(url, "alter%20table")) + mvcount(split(url,
|
|
"between")) + mvcount(split(url, "create%20table")) + mvcount(split(url, "create%20database"))
|
|
+ mvcount(split(url, "create%20index")) + mvcount(split(url, "create%20view"))
|
|
+ mvcount(split(url, "delete")) + mvcount(split(url, "drop%20database")) +
|
|
mvcount(split(url, "drop%20index")) + mvcount(split(url, "drop%20table"))
|
|
+ mvcount(split(url, "exists")) + mvcount(split(url, "exec")) + mvcount(split(url,
|
|
"group%20by")) + mvcount(split(url, "having")) + mvcount(split(url, "insert%20into"))
|
|
+ mvcount(split(url, "inner%20join")) + mvcount(split(url, "left%20join"))
|
|
+ mvcount(split(url, "right%20join")) + mvcount(split(url, "full%20join"))
|
|
+ mvcount(split(url, "select")) + mvcount(split(url, "distinct")) + mvcount(split(url,
|
|
"select%20top")) + mvcount(split(url, "union")) + mvcount(split(url, "xp_cmdshell"))
|
|
- 24 | where num_sql_cmds > 3'
|
|
suppress:
|
|
suppress_fields: dest,src,url
|
|
suppress_period: 14400s
|
|
eli5: This search looks only at your web servers and returns the source, the web server,
|
|
the URL and its length, and the user agent associated with HTTP GET requests for
|
|
extremely long URLs or user agent lengths with more than three common SQL commands
|
|
found within the URL.
|
|
entities:
|
|
- dest
|
|
how_to_implement: To successfully implement this search, you need to be monitoring
|
|
network communications to your web servers or ingesting your HTTP logs and populating
|
|
the Web data model. You must also identify your web servers in the Enterprise Security
|
|
assets table.
|
|
id: e0aad4cf-0790-423b-8328-7564d0d938f9
|
|
investigations:
|
|
- id: bc91a8cf-35e7-4bb2-8140-e756cc06fd76
|
|
name: Get Authentication Logs For Endpoint
|
|
type: splunk
|
|
- id: 3d6c3213-5fff-4a1e-b57d-b24c262171e7
|
|
name: Get Notable History
|
|
type: splunk
|
|
- id: f3fb4d1b-5f33-4b01-b541-c7af9534c242
|
|
name: Get Notable Info
|
|
type: splunk
|
|
- id: fdcfb369-1725-4c24-824a-22972d7f0d65
|
|
name: Get Risk Modifiers For Endpoint
|
|
type: splunk
|
|
known_false_positives: It's possible that legitimate traffic will have long URLs or
|
|
long user agent strings and that common SQL commands may be found within the URL.
|
|
Please investigate as appropriate.
|
|
maintainers:
|
|
- company: Splunk
|
|
email: bpatel@splunk.com
|
|
name: Bhavin Patel
|
|
mappings:
|
|
cis20:
|
|
- CIS 4
|
|
- CIS 13
|
|
- CIS 18
|
|
kill_chain_phases:
|
|
- Delivery
|
|
mitre_attack:
|
|
- Defense Evasion
|
|
- Exploitation of Vulnerability
|
|
- Execution
|
|
- Commonly Used Port
|
|
nist:
|
|
- PR.DS
|
|
- ID.RA
|
|
- PR.PT
|
|
- PR.IP
|
|
- DE.CM
|
|
modification_date: '2017-09-19'
|
|
name: SQL Injection with Long URLs
|
|
original_authors:
|
|
- company: Splunk
|
|
email: bpatel@splunk.com
|
|
name: Bhavin Patel
|
|
references: []
|
|
security_domain: network
|
|
spec_version: 2
|
|
type: splunk
|
|
version: '1.0'
|