sql_injection_with_long_urls.yml

name: SQL Injection with Long URLs
id: e0aad4cf-0790-423b-8328-7564d0d938f9
version: 3
date: '2022-03-28'
author: Bhavin Patel, Splunk
status: experimental
type: TTP
description: "The following analytic detects long URLs that contain multiple SQL commands. A proactive approach helps to detect and respond to potential threats earlier, mitigating the risks associated with SQL injection attacks. This detection is made by a Splunk query that searches for web traffic data where the destination category is a web server and the URL length is greater than 1024 characters or the HTTP user agent length is greater than 200 characters. This detection is important because it suggests that an attacker is attempting to exploit a web application through SQL injection. SQL injection is a common technique used by attackers to exploit vulnerabilities in web applications and gain unauthorized access to databases. Attackers can insert malicious SQL commands into a URL to manipulate the application's database and retrieve sensitive information or modify data. The impact of a successful SQL injection attack can be severe, potentially leading to data breaches, unauthorized access, and even complete compromise of the affected system. False positives might occur since the legitimate use of web applications or specific URLs in your environment can trigger the detection. Therefore, you must review and validate any alerts generated by this analytic before taking any action. Next steps include reviewing the source and destination of the web traffic, as well as the specific URL and HTTP user agent. Additionally, capture and analyze any relevant on-disk artifacts and review concurrent processes to determine the source of the attack."
data_source: []
search: '| tstats `security_content_summariesonly` count from datamodel=Web where
  Web.dest_category=web_server AND (Web.url_length > 1024 OR Web.http_user_agent_length
  > 200) by Web.src Web.dest Web.url Web.url_length Web.http_user_agent | `drop_dm_object_name("Web")`
  | eval url=lower(url) | eval num_sql_cmds=mvcount(split(url, "alter%20table")) +
  mvcount(split(url, "between")) + mvcount(split(url, "create%20table")) + mvcount(split(url,
  "create%20database")) + mvcount(split(url, "create%20index")) + mvcount(split(url,
  "create%20view")) + mvcount(split(url, "delete")) + mvcount(split(url, "drop%20database"))
  + mvcount(split(url, "drop%20index")) + mvcount(split(url, "drop%20table")) + mvcount(split(url,
  "exists")) + mvcount(split(url, "exec")) + mvcount(split(url, "group%20by")) + mvcount(split(url,
  "having")) + mvcount(split(url, "insert%20into")) + mvcount(split(url, "inner%20join"))
  + mvcount(split(url, "left%20join")) + mvcount(split(url, "right%20join")) + mvcount(split(url,
  "full%20join")) + mvcount(split(url, "select")) + mvcount(split(url, "distinct"))
  + mvcount(split(url, "select%20top")) + mvcount(split(url, "union")) + mvcount(split(url,
  "xp_cmdshell")) - 24 | where num_sql_cmds > 3 | `sql_injection_with_long_urls_filter`'
how_to_implement: To successfully implement this search, you need to be monitoring
  network communications to your web servers or ingesting your HTTP logs and populating
  the Web data model. You must also identify your web servers in the Enterprise Security
  assets table.
known_false_positives: It's possible that legitimate traffic will have long URLs or
  long user agent strings and that common SQL commands may be found within the URL.
  Please investigate as appropriate.
references: []
tags:
  analytic_story:
  - SQL Injection
  asset_type: Database Server
  confidence: 50
  impact: 50
  message: SQL injection attempt with url $url$ detected on $dest$
  mitre_attack_id:
  - T1190
  observable:
  - name: dest
    type: Endpoint
    role:
    - Victim
  product:
  - Splunk Enterprise
  - Splunk Enterprise Security
  - Splunk Cloud
  required_fields:
  - _time
  - Web.dest_category
  - Web.url_length
  - Web.http_user_agent_length
  - Web.src
  - Web.dest
  - Web.url
  - Web.http_user_agent
  risk_score: 25
  security_domain: network