Correlate web, WAF, and database logs to detect SQL injection attempts.
npx skills add https://github.com/riparino/Claude-Cyber --skill defensive-sqli
Please help me install this Agent Skill. Skill: defensive-sqli Source: https://github.com/riparino/Claude-Cyber/tree/main/Claude-Blue/Skills/defensive-sqli Command: npx skills add https://github.com/riparino/Claude-Cyber --skill defensive-sqli
SQL injection remains a critical attack vector. This skill helps security teams quickly detect SQL injection attempts by analyzing WAF logs, database activity, and tool indicators to enable faster containment and response.
Run the detection methodology across WAF logs, DB logs, and SIEM streams to surface SQLi events.
High-intent search queries and answers about installing and using this skill.
To detect SQL injection, you can analyze WAF logs and database telemetry by applying cross-source correlation to identify suspicious patterns. This skill surfaces actionable alerts for faster triage and response across web and database environments.
You can use KQL queries in Azure Sentinel to analyze Azure SQL audit logs and identify SQLi indicators at scale. This skill provides specific KQL guidance to automate alerting and map detections to MITRE ATT&CK T1190.
Yes, Sigma rules can surface SQL injection patterns in SIEMs and security telemetry. This skill provides Sigma rules to detect SQLi attempts, helping SOC teams perform detection engineering and incident response planning.
You can identify sqlmap artifacts by applying YARA signatures to flag automated tooling. This skill includes YARA signatures for sqlmap and related tools, alongside monitoring for database server process spawns indicative of exploitation.
The best way to correlate WAF logs with database activity is to apply cross-source correlation across web, WAF telemetry, and database logs. This surfaces actionable alerts mapping to MITRE ATT&CK T1190 and T1059 for fast triage.
You need WAF logs, database activity logs, and SIEM streams to map SQL injection detections to MITRE ATT&CK T1190 and T1059. Running the detection methodology across these sources surfaces SQLi events effectively.
riparinoDetect XSS patterns and blind XSS indicators in web logs and applications.
thoreinsteinGenerate prioritized triage checklists for production incidents and log findings to Obsidian.
aviskaarConduct proactive threat hunting campaigns using MITRE ATT&CK frameworks.
AcczdyDeploy RASP agents to detect and block in-app attacks in Java and Python web applications.
