Techniques
Sample rules
Suspicious SQL Error Messages
- source: sigma
- technicques:
- t1190
Description
Detects SQL error messages that indicate probing for an injection attack
Detection logic
condition: keywords
keywords:
- quoted string not properly terminated
- You have an error in your SQL syntax
- Unclosed quotation mark
- 'near "*": syntax error'
- SELECTs to the left and right of UNION do not have the same number of result columns