A newer version is available. For the latest information, see the current release documentation.
« Web Application Suspicious Activity: Unauthorized Method Whoami Process Activity »
Elastic Docs ›SIEM Guide [7.6] ›Detections (Beta) ›Prebuilt rule reference

Web Application Suspicious Activity: sqlmap User Agent

edit
IMPORTANT: This documentation is no longer updated. Refer to Elastic's version policy and the latest documentation.

Web Application Suspicious Activity: sqlmap User Agent

edit

This is an example of how to detect an unwanted web client user agent. This search matches the user agent for sqlmap 1.3.11, which is a popular FOSS tool for testing web applications for SQL injection vulnerabilities.

Rule indices:

  • apm-*-transaction*

Severity: medium

Risk score: 47

Runs every: 5 minutes

Searches indices from: now-6m (Date Math format, see also Additional look-back time)

Maximum signals per execution: 100

References:

Tags:

  • Elastic
  • APM

Rule version: 1

Added (Elastic Stack release): 7.6.0

Potential false positives

edit

This rule does not indicate that a SQL injection attack occurred, only that the sqlmap tool was used. Security scans and tests may result in these errors. If the source is not an authorized security tester, this is generally suspicious or malicious activity.

Rule query

edit
user_agent.original:"sqlmap/1.3.11#stable (http://sqlmap.org)"
« Web Application Suspicious Activity: Unauthorized Method Whoami Process Activity »