defensive-sqli

What problem does it solve?

SQL injection remains a critical attack vector. This skill helps security teams quickly detect SQL injection attempts by analyzing WAF logs, database activity, and tool indicators to enable faster containment and response.

Core Features & Use Cases

• Sigma rules for SQLi patterns surface detections in SIEMs and security telemetry.
• KQL queries for Azure Sentinel/Azure SQL audit logs identify SQLi indicators at scale.
• YARA signatures for sqlmap artifacts and related tools help flag automated tooling.
• Monitoring for database server process spawns indicative of exploitation and post-exploitation activity.
• Use Case: SOC teams perform detection engineering, triage, and IR planning for web app attacks.

Quick Start

Run the detection methodology across WAF logs, DB logs, and SIEM streams to surface SQLi events.