Potential SQL Injection Attempts from IIS Logs

Ankit Mehta@Secvyn

•updated Jun 13, 2026•0•0•5

This rule detects potential SQL Injection attempts by monitoring IIS web server logs (W3CIISLog) for URI queries containing common SQL keywords such as 'union', 'select', or 'drop'. It aggregates these attempts by client IP address over one-hour intervals and flags any IP address with 5 or more such attempts within that hour.