Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
159 detections
Filters
Last updated
All Time
Detection languages
91
23
18
7
7
Contributors
46
40
17
14
9
Categories
20,417
11,806
5,870
5,145
4,864
Platforms
73
63
17
16
10
Products / Services
52
41
27
26
25
MITRE Techniques
48
46
37
28
27
CVEs
11
3
3
2
1
IDS Classtypes
6
1
IDS Protocols
7
Detects the creation or alteration of a SQL trigger that utilizes sp_invoke_external_rest_endpoint. Attackers can abuse database triggers to automatically exfiltrate newly added credentials or sensitive records in real-time.
Detects high-volume SQL operations indicative of data manipulation attacks
This rule detects attempts to enable the 'xp_cmdshell' stored procedure in Microsoft SQL Server. The rule specifically looks for network traffic on port 1433 (default SQL Server port) containing the keywords 'sp_configure', 'xp_cmdshell', and '1' (indicating enablement). Enabling xp_cmdshell allows SQL Server to execute operating system commands, which is a common technique used by attackers for remote execution and persistence.
This rule detects attempts to manipulate stored records within an MSSQL database. It specifically looks for TCP traffic directed to port 1433 (the default MSSQL port) containing the keywords "UPDATE" and "SET" (case-insensitive) in the flow to the server. A threshold of 50 occurrences within 30 seconds from the same source IP is set to trigger an alert, indicating potential bulk data modification.
This rule detects attempts to manipulate database data on a remote MySQL server (port 3306) by identifying 'UPDATE' and 'SET' SQL commands within TCP traffic. It uses a threshold to alert on a high frequency of these commands from a single source, indicating potential malicious activity like data modification or integrity compromise.
MySQL Database DROP TABLE Attack
Suricata
This rule detects attempts to drop tables in a MySQL database. It specifically looks for the 'DROP TABLE' string in TCP traffic directed to the standard MySQL port (3306) on the home network. This activity is often indicative of malicious intent, such as data destruction or database tampering.
This rule detects attempts to create a stored procedure in a Microsoft SQL Server database that includes the 'xp_cmdshell' extended stored procedure. 'xp_cmdshell' allows execution of operating system commands directly from SQL Server, and its use in a newly created stored procedure can indicate an attacker establishing persistence or attempting to execute arbitrary commands on the underlying system.
This rule detects attempts to modify stored data within a MySQL database, specifically looking for 'UPDATE' and 'WHERE' clauses in TCP traffic directed to the MySQL default port (3306). It triggers an alert if 50 such events are observed from the same source IP within a 30-second window, indicating potential malicious activity aimed at data integrity compromise.
Detects the creation of a new MariaDB User-Defined Function (UDF) that loads a shared object (.so or .dll) file. This technique is used in the final stage of the CVE-2026-32710 attack chain to execute arbitrary OS commands, often from suspicious temporary or public directories.
Detects BigQuery queries using CONCAT with CHR functions to dynamically build cross-project paths, bypassing dot filters. High-fidelity indicator of LeakyLooker-style SQL injection.
SQL Database Version Discovery
Suricata
This rule detects attempts to discover the version of a SQL database, often a precursor to SQL injection attacks or other reconnaissance activities. It specifically looks for SQL queries containing keywords like 'select' and 'version' in various common formats used to retrieve database version information.
Detects a series of Salesforce Object Query Language (SOQL) queries indicative of data reconnaissance and exfiltration, similar to techniques used by UNC6395.
This detection identifies potentially suspicious usage of Invoke-Sqlcmd PowerShell cmdlet, which can be used for database operations and potential data exfiltration. The detection looks for suspicious parameter combinations and query patterns that may indicate unauthorized database access, data theft, or malicious database operations. Threat actors may prefer using PowerShell Invoke-Sqlcmd over sqlcmd.exe as it provides a more flexible programmatic interface and can better evade detection.
This detection identifies potentially suspicious usage of sqlcmd.exe, focusing on command patterns that may indicate data exfiltration, reconnaissance, or malicious database operations. The detection looks for both short-form (-X) and long-form (--flag) suspicious parameter combinations, which have been observed in APT campaigns targeting high-value organizations. For example, threat actors like CL-STA-0048 have been known to abuse sqlcmd.exe for data theft and exfiltration from compromised MSSQL servers. The detection monitors for suspicious authentication attempts, output redirection, and potentially malicious query patterns that could indicate unauthorized database access or data theft.
Detects the execution of specific SOQL (Salesforce Object Query Language) queries associated with the UNC6395 data theft campaign. The actor used these queries to enumerate and exfiltrate data from sensitive Salesforce objects.
'This query combines different SQL alerts with CommonSecurityLogs and AuditLogs helping analysts /investigate any possible SQL related attacks faster
thus reducing Mean Time To Respond'
thus reducing Mean Time To Respond'
'This hunting query looks for queries that appear to be looking for secrets or passwords in tables.'
'This hunting query looks for users who have multiple failed queries in a short space of time.'
'This hunting query looks for anomalously large LA queries by users.'
'This hunting query looks for new Service Principals running queries that have not previously been seen running queries.'
'This hunting query looks for clients running queries that have not previously been seen running queries.'
Page 7 of 8