Detection rules › Kusto

Contrast ADR - DLP SQL Injection Correlation

This is a third-party alert feed, not a detection over modeled telemetry. The vendor product raised the finding; this rule forwards it into the SIEM. It is searchable for reference but is excluded from the detection-rule browse and the ATT&CK coverage matrix.

Status: available
Severity: high
Time window: 5m
Source: github.com/Azure/Azure-Sentinel

'Detects successful SQL injection attacks identified by Contrast ADR and correlates them with WAF/DLP logs. This rule identifies critical database security breaches that have bypassed initial defenses and may result in data exfiltration or unauthorized database access.'

MITRE ATT&CK coverage

Tactic	Techniques
Reconnaissance	`T1590` Gather Victim Network Information
Initial Access	`T1190` Exploit Public-Facing Application
Credential Access	`T1528` Steal Application Access Token `T1552` Unsecured Credentials
Discovery	`T1046` Network Service Discovery
Lateral Movement	`T1021` Remote Services
Collection	`T1005` Data from Local System
Command & Control	`T1008` Fallback Channels `T1571` Non-Standard Port
Exfiltration	`T1041` Exfiltration Over C2 Channel

Rule body

id: 1aac7737-d52f-483d-b225-6a27c1b29a9e
name: Contrast ADR - DLP SQL Injection Correlation
description: |
  'Detects successful SQL injection attacks identified by Contrast ADR and correlates them with WAF/DLP logs. This rule identifies critical database security breaches that have bypassed initial defenses and may result in data exfiltration or unauthorized database access.'
severity: High
status: Available
requiredDataConnectors:
  - connectorId: ContrastADRCCF
    dataTypes:
      - ContrastADRAttackEvents_CL
queryFrequency: 5m
queryPeriod: 5m
triggerOperator: gt
triggerThreshold: 0
tactics:
  - InitialAccess
  - CredentialAccess
  - Collection
  - Exfiltration
  - CommandAndControl
  - Reconnaissance
  - CredentialAccess
  - LateralMovement
  - Discovery 
relevantTechniques:
  - T1190
  - T1552
  - T1005
  - T1041
  - T1008
  - T1590
  - T1571
  - T1528
  - T1021
  - T1046
query: |
  ContrastADRAttackEvents_CL
  | where result =~ "EXPLOITED" and rule =~ "SQL-INJECTION"
  | project-rename hostname = host_hostname
  //please add your DLP logs table in place of ContrastWAFLogs_CL and hostname colomun in place of hostname below and uncomment the queries below
  //| join kind= inner (ContrastWAFLogs_CL | where TimeGenerated >= ago(5m)) on hostname
entityMappings:
  - entityType: IP
    fieldMappings:
      - identifier: Address
        columnName: sourceIp
  - entityType: Host
    fieldMappings:
      - identifier: HostName
        columnName: hostname
alertDetailsOverride:
  alertDisplayNameFormat: 'Confirmed active SQL Injection by Contrast ADR on {{request_headers_referer}}  endpoint of {{application_name}} '
  alertDescriptionFormat: 'Confirmed active SQL Injection by Contrast ADR on {{request_headers_referer}}  endpoint of {{application_name}} '
incidentConfiguration:
  createIncident: true
  groupingConfiguration:
    enabled: true
    reopenClosedIncident: false
    lookbackDuration: PT30M
    matchingMethod: Selected
    groupByEntities:
      - Host
      - IP
eventGroupingSettings:
  aggregationKind: AlertPerResult
kind: Scheduled
version: 1.0.1

Stages and Predicates

Stage 1: `source`

ContrastADRAttackEvents_CL

Stage 2: `where`

| where result =~ "EXPLOITED" and rule =~ "SQL-INJECTION"

Stage 3: `project-rename`

| project-rename hostname = host_hostname

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`result`	eq	`EXPLOITED`	`field:"result" kind:eq value:"EXPLOITED"`
`rule`	eq	`SQL-INJECTION`	`field:"rule" kind:eq value:"SQL-INJECTION"`

Output fields

These fields are emitted when the rule matches.

Field	Source
`hostname`	`project-rename`