Suspicious SQL Query Keywords

SigmaHQ Detections@sigmaHQ

•updated May 20, 2025•0•44

Detects suspicious SQL query keywords that are often used during reconnaissance, data exfiltration, or destructive activities. This includes keywords like 'drop', 'truncate', 'dump', and 'select *', which can indicate attempts to manipulate database structures, extract sensitive information, or perform denial-of-service attacks.