ATT&CK T1190 - SQL Injection Attempt

Darshan Thummar@Mighty

•updated Jun 10, 2026•0•0•1

This rule detects attempts at SQL Injection by looking for the specific string "' OR '1'='1" within the HTTP URI. This string is a common payload used in SQL injection attacks to bypass authentication or extract data by always evaluating to true.