Credential Access via Web Application Exploit

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•3

This rule detects attempts to gain credential access through web application exploits, specifically looking for HTTP URI requests that contain both 'UNION SELECT' (indicative of SQL injection) and 'password' (suggesting an attempt to extract credential-related information). The detection is case-insensitive.