ATT&CK T1190 - SQL Injection UNION SELECT

Darshan Thummar@Mighty

•updated Jun 10, 2026•0•0•1

This rule detects attempts at SQL Injection using the 'UNION SELECT' statement within HTTP URI requests. It specifically looks for the case-insensitive string 'UNION SELECT' in the URI of HTTP traffic flowing to the server.