Microsoft Sentinel high experimental kql

Tomcat - Sql injection patterns

'Detects possible sql injection patterns'

View Source

Detection Logic

let commands = dynamic(["1/*'*/", "1'
| 
| 'asd'
| 
| '", "'1'='1", "1' or '1'='1", "1 or 1=1", "1=1", "1/*!1111'*/", "'or''='"]);
TomcatEvent
| where UrlOriginal has_any (commands)
| extend UrlCustomEntity = UrlOriginal

Field Validations

Loading…

Comments (0)

Loading comments...