security_content/detections/web/sql_injection_with_long_urls.yml at develop · devhhu/security_content · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
name: SQL Injection with Long URLs
id: e0aad4cf-0790-423b-8328-7564d0d938f9
version: 7
date: '2025-05-02'
author: Bhavin Patel, Splunk
status: experimental
type: TTP
description: The following analytic detects long URLs containing multiple SQL commands,
  indicating a potential SQL injection attack. This detection leverages web traffic
  data, specifically targeting web server destinations with URLs longer than 1024
  characters or HTTP user agents longer than 200 characters. SQL injection is significant
  as it allows attackers to manipulate a web application's database, potentially leading
  to unauthorized data access or modification. If confirmed malicious, this activity
  could result in data breaches, unauthorized access, and complete system compromise.
  Immediate investigation and validation of alerts are crucial to mitigate these risks.
data_source: []
search: '| tstats `security_content_summariesonly` count from datamodel=Web where
  Web.dest_category=web_server AND (Web.url_length > 1024 OR Web.http_user_agent_length
  > 200) by Web.src Web.dest Web.url Web.url_length Web.http_user_agent | `drop_dm_object_name("Web")`
  | eval url=lower(url) | eval num_sql_cmds=mvcount(split(url, "alter%20table")) +
  mvcount(split(url, "between")) + mvcount(split(url, "create%20table")) + mvcount(split(url,
  "create%20database")) + mvcount(split(url, "create%20index")) + mvcount(split(url,
  "create%20view")) + mvcount(split(url, "delete")) + mvcount(split(url, "drop%20database"))
  + mvcount(split(url, "drop%20index")) + mvcount(split(url, "drop%20table")) + mvcount(split(url,
  "exists")) + mvcount(split(url, "exec")) + mvcount(split(url, "group%20by")) + mvcount(split(url,
  "having")) + mvcount(split(url, "insert%20into")) + mvcount(split(url, "inner%20join"))
  + mvcount(split(url, "left%20join")) + mvcount(split(url, "right%20join")) + mvcount(split(url,
  "full%20join")) + mvcount(split(url, "select")) + mvcount(split(url, "distinct"))
  + mvcount(split(url, "select%20top")) + mvcount(split(url, "union")) + mvcount(split(url,
  "xp_cmdshell")) - 24 | where num_sql_cmds > 3 | `sql_injection_with_long_urls_filter`'
how_to_implement: To successfully implement this search, you need to be monitoring
  network communications to your web servers or ingesting your HTTP logs and populating
  the Web data model. You must also identify your web servers in the Enterprise Security
  assets table.
known_false_positives: It's possible that legitimate traffic will have long URLs or
  long user agent strings and that common SQL commands may be found within the URL.
  Please investigate as appropriate.
references: []
rba:
  message: SQL injection attempt with url $url$ detected on $dest$
  risk_objects:
  - field: dest
    type: system
    score: 25
  threat_objects: []
tags:
  analytic_story:
  - SQL Injection
  asset_type: Database Server
  mitre_attack_id:
  - T1190
  product:
  - Splunk Enterprise
  - Splunk Enterprise Security
  - Splunk Cloud
  security_domain: network