SQL injection probing followed by successful login access on web apps
Detects potential SQL injection probing followed by a successful authentication response (HTTP 302) from the same external client IP within a short timeframe on IIS web servers.
Microsoft Sentinel (KQL)

