Query: detect Detects potential SQL injection attempts via GET requests in access logs. in logs
Matching passage: Sigma rule: Detects potential SQL injection attempts via GET requests in access logs.. Logsource: webserver. Rule: title: SQL Injection Strings In URI id: 5513deaf-f49a-46c2-a6c8-3f111b5cb453 status: test description: Detects potential SQL injection attempts via GET requests in access logs. references: - https://www.acunetix.com/blog/articles/exploiting-sql-injection-example/ - https://www.acunetix.com/blog/articles/using-logs-to-investigate-a-web-application-attack/ - https://brightsec.com/blog/sql-injection-payloads/ - https://github.com/payloadbox/sql-injection-payload-list - https://book.hacktricks.xyz/pentesting-web/sql-injection/mysql-injection author: Saw Win Naung, Nasreddine Bencherchali (Nextron Systems), Thurein Oo (Yoma Bank) date: 2020-02-22 modified: 2023-09-04 tags: - attack.initial-access - attack.t1190 logsource: category: webserver detection: selection: cs-method: GET keywords: - '@@version' - '%271%27%3D%271' - '=select ' - =select( - =select%20 - concat_ws( - CONCAT(0x - from mysql.innodb_table_stats - from%20mysql.innodb_table_stats - group_concat( - information_schema.tables - json_arrayagg( - or 1=1# - or%201=1# - 'order by ' - order%20by%20 - 'select * ' - select database() - select version() - select%20*%20 - select%20database() - select%20version() - select%28sleep%2810%29 - SELECTCHAR( - table_schema - UNION ALL SELECT - UNION SELECT - UNION%20ALL%20SELECT - UNION%20SELECT - '''1''=''1' filter_main_status: sc-status: 404 condition: selection and keywords and not 1 of filter_main_* falsepositives: - Java scripts and CSS Files - User searches in search boxes of the respective website - Internal vulnerability scanners can cause some serious FPs when used, if you experience a lot of FPs due to this think of adding more filters such as "User Agent" strings and more response codes level: high
Near-miss passage: Sigma rule: Dependabot performs a scan to detect insecure dependencies, and sends Dependabot alerts. This rule detects when an organ. Logsource: github / audit. Rule: title: Outdated Dependency Or Vulnerability Alert Disabled id: 34e1c7d4-0cd5-419d-9f1b-1dad3f61018d status: test description: 'Dependabot performs a scan to detect insecure dependencies, and sends Dependabot alerts. This rule detects when an organization owner disables Dependabot alerts private repositories or Dependabot security updates for all repositories. ' author: Muhammad Faisal (@faisalusuf) date: 2023-01-27 references: - https://docs.github.com/en/code-security/dependabot/dependabot-alerts/about-dependabot-alerts - https://docs.github.com/en/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization tags: - attack.initial-access - attack.t1195.001 logsource: product: github service: audit definition: 'Requirements: The audit log streaming feature must be enabled to be able to receive such logs. You can enable following the documentation here: https://docs.github.com/en/enterprise-cloud@latest/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/streaming-the-audit-log-for-your-enterprise#setting-up-audit-log-streaming' detection: selection: action: - dependabot_alerts_new_repos.disable - dependabot_alerts.disable - dependabot_security_updates_new_repos.disable - dependabot_security_updates.disable - repository_vulnerability_alerts.disable condition: selection falsepositives: - Approved changes by the Organization owner. Please validate the 'actor' if authorized to make the changes. level: high