Detectionmediumtest
Suspicious SQL Query
Detects suspicious SQL query keywrods that are often used during recon, exfiltration or destructive activities. Such as dropping tables and selecting wildcard fields
Convert In Phoenix Studio
Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.
Launch
Log Source
database
Categorydatabase← raw: database
Definition
Requirements: Must be able to log the SQL queries
Detection Logic
Detection Logic1 selector
detection:
keywords:
- 'drop'
- 'truncate'
- 'dump'
- 'select \*'
condition: keywordsFalse Positives
Inventory and monitoring activity
Vulnerability scanners
Legitimate applications
References
MITRE ATT&CK
Rule Metadata
Rule ID
d84c0ded-edd7-4123-80ed-348bb3ccc4d5
Status
test
Level
medium
Type
Detection
Created
Tue Dec 27
Author
Path
rules/category/database/db_anomalous_query.yml
Raw Tags
attack.exfiltrationattack.initial-accessattack.privilege-escalationattack.persistenceattack.t1190attack.t1505.001