Elastic high stable kql

Potential SQL Injection Against Microsoft SQL Server

Identifies potential SQL injection attempts against Microsoft SQL Server by detecting obfuscated T-SQL patterns in SQL Server Audit events. Attackers use CHAR concatenation, CONVERT-based subqueries, and CASE/UNION constructs to bypass input validation and extract data or execute unauthorized statements.

View Source

Detection Logic

from logs-system.application-*, logs-windows.forwarded*, winlogbeat-* metadata _id, _version, _index
| where host.os.type == "windows" and winlog.provider_name like "MSSQL*" and event.code == "33205"
| EVAL message_upper = TO_UPPER(message)
| where (
    message_upper RLIKE ".*CONVERT\\(INT,\\(
SELECT (CHAR\\(\\d{1,3}\\)\\+){3,}.*" or 
    message_upper RLIKE ".*(CHAR\\(\\d{1,3}\\)\\+){3,}CHAR\\(\\d{1,3}\\).*" or 
    message_upper RLIKE ".*CASE WHEN \\(\\d+=\\d+\\).*UNION 
SELECT \\d+.*" or
    message_upper RLIKE ".*WAITFOR DELAY \\'0:0:\\d+\\'.*" or
    message_upper RLIKE ".*;\\s*(EXEC
| EXECUTE)\\s*\\(?\\s*(MASTER\\.)?\\.?XP_CMDSHELL.*" or
    message_upper RLIKE ".*UNION 
SELECT (NULL\\s*,\\s*){2,}NULL.*" or
    message_upper RLIKE ".*'\\w*'\\s*\\+\\s*\\(\\(
SELECT @@VERSION\\)\\)\\s*\\+\\s*'\\w*'.*" or
    message_upper RLIKE ".*(
OR
| AND)\\s+'?\\d+'?\\s*=\\s*'?\\d+'?\\s*--.*"
  )
| eval Esql.original_message = message
| keep
    @timestamp,
    host.id,
    host.name,
    host.ip,
    winlog.computer_name,
    message,
    event.outcome,
    Esql.original_message,
    _id,
    _version,
    _index,
    data_stream.namespace
| limit 10

Field Validations

Loading…

Comments (0)

Loading comments...