SQL Database Version Discovery

Tim Peck@timpeck

•updated Nov 11, 2025•0•46

This rule detects attempts to discover the version of a SQL database, often a precursor to SQL injection attacks or other reconnaissance activities. It specifically looks for SQL queries containing keywords like 'select' and 'version' in various common formats used to retrieve database version information.