Skip to content
Threat Feed
Subscribe
high advisory

Detection of SQL Injection Payloads in Web Server Access Logs

This brief provides detection logic for identifying common SQL injection (SQLi) payloads embedded within HTTP GET requests in web server access logs.

Triage facts

Revision 1
Evidence
Unknown
Severity
High
Action
Elevated
Sources
1 public source
Freshness
Revision 1Nov 10, 11:53 UTC
Detection
1 rule
Source quality
A2Roughly even chance

This alert documents a detection capability for identifying SQL injection attempts targeting web applications. Attackers frequently use SQLi to query database structures, extract sensitive data, or bypass authentication mechanisms by manipulating GET request parameters. The provided detection logic specifically targets common database-specific keywords and syntax observed in web server access logs, such as UNION SELECT, information_schema, and sleep-based blind SQLi payloads.

Recommendation

  • Deploy the Sigma rule below to the SIEM or Log Management system to identify potential SQL injection attempts.
  • Monitor high-frequency triggers of this rule to distinguish between actual exploitation attempts and legitimate application behavior, such as search functionality or internal vulnerability scanners.
  • Integrate additional context, such as User-Agent headers, to differentiate between automated scanning tools and user-initiated browser requests.

Immediate actions

Deploy Sigma rule to identify SQLi patterns in web traffic

Detection Engineering 48h

Threat Hunt

Identify anomalies in cs-uri-query for high-frequency or unusual patterns

T1190 medium medium confidence convert to detection

Data: webserver access logs

Detection coverage 1

Detect SQL Injection Strings In URI

high

Detects common SQL injection patterns in HTTP GET requests by monitoring for database-specific commands and syntax in web server access logs.

sigma tactics: initial_access techniques: T1190 sources: webserver

Detection queries are available on the platform. Get full rules →