Skip to main content
Tier One
Medium

IDS signature for SQL injection against the supplier portal

A-1065

00:00time on this alert, target 20 minutes

Back to queue

Alert details

Source
IDS
Detection rule
IDS-WEB-SQLI-044
Affected user
external
Affected host
SRV-ERP-02
Source IP
212.102.35.9
First seen
2026-07-24T17:24:00Z

Why this fired, in plain English

Someone sent web requests containing database commands, trying to trick the application into leaking data.

Suggested playbook

Lateral movement

  1. 1. Check whether the source is a known scanner in the asset database.
  2. 2. Measure the spread: how many hosts, over how long, on which ports?
  3. 3. Look for file writes to remote admin shares.
  4. 4. Check logon types: 3 (network), 9 (runas), 10 (RDP) tell you how credentials were used.
Open the full checklist

Raw log evidence

Exactly what the tools recorded — 3 events.

  1. Guided hint: this line matters

    ts=2026-07-24T17:22:11Z src="ids" event=signature_match sig="SQLI UNION SELECT" src_ip=212.102.35.9 dest_ip=10.20.9.40 dest_port=443 uri="/supplier/search?q=1%27%20UNION%20SELECT%20null,version()--"

    UNION SELECT is a standard SQL injection probe.

  2. Guided hint: this line matters

    ts=2026-07-24T17:22:12Z src="waf" event=block rule="SQLI-CORE-942100" src_ip=212.102.35.9 action=deny response_code=403 count=118

    The web application firewall blocked all 118 attempts with a 403.

  3. Guided hint: this line matters

    ts=2026-07-24T17:23:02Z src="app" event=db_query_errors host=SRV-ERP-02 count=0 window="17:20-17:25"

    The application database saw no errors, so nothing reached it.

Related events

The order things happened in.

  1. 17:22Z

    118 SQLi probes from one IP

  2. 17:22Z

    All blocked by the WAF

Enrichment lookups

Mock lookups. Run each one yourself — a real analyst never guesses what a lookup would have said. There is no "run everything" button on purpose.

0 of 3 lookups checked

  • Not checked yet.

  • Not checked yet.

  • Not checked yet.

techniques

Your verdict

Keyboard shortcuts 1–4, or click. You can always change your mind afterwards.