Suspicious SQL Query

Title: Suspicious SQL Query
Status: test
Description:Detects suspicious SQL query keywrods that are often used during recon, exfiltration or destructive activities. Such as dropping tables and selecting wildcard fields
References:
  -https://github.com/sqlmapproject/sqlmap
Author: @juju4
Date: 2022-12-27
modified:None
Tags:

• -'attack.exfiltration'
• -'attack.initial-access'
• -'attack.privilege-escalation'
• -'attack.persistence'
• -'attack.t1190'
• -'attack.t1505.001'

Logsource:

• category: database
• definition: Requirements: Must be able to log the SQL queries

Detection:
  keywords:
    - 'drop'
    - 'truncate'
    - 'dump'
    - 'select \*'
  condition:keywords
Falsepositives:
  -Inventory and monitoring activity
  -Vulnerability scanners
  -Legitimate applications
Level: medium