SQL Injection Attempt
This rule detects potential SQL injection attempts by looking for specific keywords and patterns within the 'cs_uri_query' field of Cloudflare WAF logs. These patterns, such as 'UNION SELECT', '' OR 1=1', 'information_schema', and '--', are commonly used in SQL injection attacks to extract information, bypass authentication, or comment out parts of SQL queries. The rule aims to identify malicious requests targeting web applications that could lead to unauthorized database access or manipulation.
Microsoft Sentinel (KQL)
