SQL Injection Strings In URI

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•4•1•40

This rule detects potential SQL injection attempts by looking for common SQL injection strings and keywords within the URI of GET requests in web server access logs. It specifically targets patterns often used to extract database information, bypass authentication, or execute arbitrary SQL commands.