Query: alert when Detects potential SQL injection attempts via GET requests in access logs.
Matching passage: Sigma rule: Detects potential SQL injection attempts via GET requests in access logs.. Logsource: webserver. Rule: title: SQL Injection Strings In URI id: 5513deaf-f49a-46c2-a6c8-3f111b5cb453 status: test description: Detects potential SQL injection attempts via GET requests in access logs. references: - https://www.acunetix.com/blog/articles/exploiting-sql-injection-example/ - https://www.acunetix.com/blog/articles/using-logs-to-investigate-a-web-application-attack/ - https://brightsec.com/blog/sql-injection-payloads/ - https://github.com/payloadbox/sql-injection-payload-list - https://book.hacktricks.xyz/pentesting-web/sql-injection/mysql-injection author: Saw Win Naung, Nasreddine Bencherchali (Nextron Systems), Thurein Oo (Yoma Bank) date: 2020-02-22 modified: 2023-09-04 tags: - attack.initial-access - attack.t1190 logsource: category: webserver detection: selection: cs-method: GET keywords: - '@@version' - '%271%27%3D%271' - '=select ' - =select( - =select%20 - concat_ws( - CONCAT(0x - from mysql.innodb_table_stats - from%20mysql.innodb_table_stats - group_concat( - information_schema.tables - json_arrayagg( - or 1=1# - or%201=1# - 'order by ' - order%20by%20 - 'select * ' - select database() - select version() - select%20*%20 - select%20database() - select%20version() - select%28sleep%2810%29 - SELECTCHAR( - table_schema - UNION ALL SELECT - UNION SELECT - UNION%20ALL%20SELECT - UNION%20SELECT - '''1''=''1' filter_main_status: sc-status: 404 condition: selection and keywords and not 1 of filter_main_* falsepositives: - Java scripts and CSS Files - User searches in search boxes of the respective website - Internal vulnerability scanners can cause some serious FPs when used, if you experience a lot of FPs due to this think of adding more filters such as "User Agent" strings and more response codes level: high
Near-miss passage: Sigma rule: Detects initiated network connections to crypto mining pools. It indicates that the system is likely infected with a cry. Logsource: windows / network_connection. Rule: title: Network Communication With Crypto Mining Pool id: fa5b1358-b040-4403-9868-15f7d9ab6329 status: stable description: 'Detects initiated network connections to crypto mining pools. It indicates that the system is likely infected with a crypto miner malware or is being used for crypto mining. ' references: - https://www.poolwatch.io/coin/monero - https://github.com/stamparm/maltrail/blob/da082537e0f37b9dece3a6998583e43bb5709c4e/trails/static/suspicious/crypto_mining.txt - https://www.virustotal.com/gui/search/behaviour_network%253A*.miningocean.org/files author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) date: 2021-10-26 modified: 2026-07-24 tags: - attack.impact - attack.t1496 logsource: category: network_connection product: windows detection: selection: DestinationHostname: - aeon-pool.com - alimabi.cn - ap.luckpool.net - api.fastpool.xyz - auto.c3pool.org - awgoaigartnj-xmr.com - backup.fastpool.xyz - bcn.pool.minergate.com - bcn.vip.pool.minergate.com - bizxmr.cc - bmpool.org - bohemianpool.com - byw.dscloud.me - c3.wptask.cyou - c3pool.org - ca-aipg.miningocean.org - ca-dynex.miningocean.org - ca-neurai.miningocean.org - ca-qrl.miningocean.org - ca-upx.miningocean.org - ca-zephyr.miningocean.org - ca.minexmr.com - ca.monero.herominers.com - cbd.monerpool.org - cbdv2.monerpool.org - community-pools.mysrv.cloud - covid19crypto.com - cryptmonero.com - crypto-pool.fr - crypto-pool.info - cryptominded.com - cryptonight-hub.miningpoolhub.com - d1pool.ddns.net - d5pool.us - daili01.monerpool.org - de-aipg.miningocean.org - de-dynex.miningocean.org - de-zephyr.miningocean.org - de.minexmr.com - de.moneroocean.stream - de.salvium.herominers.com - de.zephyr.herominers.com - dl.nbminer.com - donate.graef.in - donate.ssl.xmrig.com - donate.v2.xmrig.com - donate.xmrig.com - donate2.graef.in - drill.moneroworld.com - dwarfpool.com - emercoin.com - emercoin.net - emergate.net - ethereumpool.co - eu.luckpool.net - eu.minerpool.pw - f2pool.com - fastpool.xyz - fcn-xmr.pool.minergate.com - fee.xmrig.com - fi.moneroocean.stream - fr-aipg.miningocean.org - fr-dynex.miningocean.org - fr-neurai.miningocean.org - fr-qrl.miningocean.org - fr-tarirx.luckypool.io - fr-upx.miningocean.org - fr-zephyr.miningocean.org - fr.minexmr.com - fr.moneroocean.stream - friendspool.club - ftp.fastpool.xyz - gandalph3000.com - googleminer.com - grin.2miners.com - gulf.moneroocean.stream - hellominer.com - herominers.com - hk-aipg.miningocean.org - hk-dynex.