mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
Bhavin Patel
61 lines
4.0 KiB
YAML
61 lines
4.0 KiB
YAML
name: SQL Injection with Long URLs
|
|
id: e0aad4cf-0790-423b-8328-7564d0d938f9
|
|
version: 3
|
|
date: '2022-03-28'
|
|
author: Bhavin Patel, Splunk
|
|
status: experimental
|
|
type: TTP
|
|
description: "The following analytic detects long URLs that contain multiple SQL commands. A proactive approach helps to detect and respond to potential threats earlier, mitigating the risks associated with SQL injection attacks. This detection is made by a Splunk query that searches for web traffic data where the destination category is a web server and the URL length is greater than 1024 characters or the HTTP user agent length is greater than 200 characters. This detection is important because it suggests that an attacker is attempting to exploit a web application through SQL injection. SQL injection is a common technique used by attackers to exploit vulnerabilities in web applications and gain unauthorized access to databases. Attackers can insert malicious SQL commands into a URL to manipulate the application's database and retrieve sensitive information or modify data. The impact of a successful SQL injection attack can be severe, potentially leading to data breaches, unauthorized access, and even complete compromise of the affected system. False positives might occur since the legitimate use of web applications or specific URLs in your environment can trigger the detection. Therefore, you must review and validate any alerts generated by this analytic before taking any action. Next steps include reviewing the source and destination of the web traffic, as well as the specific URL and HTTP user agent. Additionally, capture and analyze any relevant on-disk artifacts and review concurrent processes to determine the source of the attack."
|
|
data_source: []
|
|
search: '| tstats `security_content_summariesonly` count from datamodel=Web where
|
|
Web.dest_category=web_server AND (Web.url_length > 1024 OR Web.http_user_agent_length
|
|
> 200) by Web.src Web.dest Web.url Web.url_length Web.http_user_agent | `drop_dm_object_name("Web")`
|
|
| eval url=lower(url) | eval num_sql_cmds=mvcount(split(url, "alter%20table")) +
|
|
mvcount(split(url, "between")) + mvcount(split(url, "create%20table")) + mvcount(split(url,
|
|
"create%20database")) + mvcount(split(url, "create%20index")) + mvcount(split(url,
|
|
"create%20view")) + mvcount(split(url, "delete")) + mvcount(split(url, "drop%20database"))
|
|
+ mvcount(split(url, "drop%20index")) + mvcount(split(url, "drop%20table")) + mvcount(split(url,
|
|
"exists")) + mvcount(split(url, "exec")) + mvcount(split(url, "group%20by")) + mvcount(split(url,
|
|
"having")) + mvcount(split(url, "insert%20into")) + mvcount(split(url, "inner%20join"))
|
|
+ mvcount(split(url, "left%20join")) + mvcount(split(url, "right%20join")) + mvcount(split(url,
|
|
"full%20join")) + mvcount(split(url, "select")) + mvcount(split(url, "distinct"))
|
|
+ mvcount(split(url, "select%20top")) + mvcount(split(url, "union")) + mvcount(split(url,
|
|
"xp_cmdshell")) - 24 | where num_sql_cmds > 3 | `sql_injection_with_long_urls_filter`'
|
|
how_to_implement: To successfully implement this search, you need to be monitoring
|
|
network communications to your web servers or ingesting your HTTP logs and populating
|
|
the Web data model. You must also identify your web servers in the Enterprise Security
|
|
assets table.
|
|
known_false_positives: It's possible that legitimate traffic will have long URLs or
|
|
long user agent strings and that common SQL commands may be found within the URL.
|
|
Please investigate as appropriate.
|
|
references: []
|
|
tags:
|
|
analytic_story:
|
|
- SQL Injection
|
|
asset_type: Database Server
|
|
confidence: 50
|
|
impact: 50
|
|
message: SQL injection attempt with url $url$ detected on $dest$
|
|
mitre_attack_id:
|
|
- T1190
|
|
observable:
|
|
- name: dest
|
|
type: Endpoint
|
|
role:
|
|
- Victim
|
|
product:
|
|
- Splunk Enterprise
|
|
- Splunk Enterprise Security
|
|
- Splunk Cloud
|
|
required_fields:
|
|
- _time
|
|
- Web.dest_category
|
|
- Web.url_length
|
|
- Web.http_user_agent_length
|
|
- Web.src
|
|
- Web.dest
|
|
- Web.url
|
|
- Web.http_user_agent
|
|
risk_score: 25
|
|
security_domain: network
|