Microsoft Sentinel high experimental kql

NGINX - Sql injection patterns

'Detects possible sql injection patterns'

View Source

Detection Logic

let sql_patterns = dynamic([@"1/*'*/", @"1'
| 
| 'asd'
| 
| '", @"'1'='1", @"1' or '1'='1", @"1 or 1=1", @"1=1", @"1/*!1111'*/", @"'or''='"]);
NGINXHTTPServer
| where UrlOriginal has_any (sql_patterns)
| extend IPCustomEntity = SrcIpAddr, UrlCustomEntity = UrlOriginal

Field Validations

Loading…

Comments (0)

Loading comments...