Detection rules › Kusto
Contrast ADR - DLP SQL Injection Correlation
This is a third-party alert feed, not a detection over modeled telemetry. The vendor product raised the finding; this rule forwards it into the SIEM. It is searchable for reference but is excluded from the detection-rule browse and the ATT&CK coverage matrix.
'Detects successful SQL injection attacks identified by Contrast ADR and correlates them with WAF/DLP logs. This rule identifies critical database security breaches that have bypassed initial defenses and may result in data exfiltration or unauthorized database access.'
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Reconnaissance | T1590 Gather Victim Network Information |
| Initial Access | T1190 Exploit Public-Facing Application |
| Credential Access | T1528 Steal Application Access Token, T1552 Unsecured Credentials |
| Discovery | T1046 Network Service Discovery |
| Lateral Movement | T1021 Remote Services |
| Collection | T1005 Data from Local System |
| Command & Control | T1008 Fallback Channels, T1571 Non-Standard Port |
| Exfiltration | T1041 Exfiltration Over C2 Channel |
Rule body kusto
id: 1aac7737-d52f-483d-b225-6a27c1b29a9e
name: Contrast ADR - DLP SQL Injection Correlation
description: |
'Detects successful SQL injection attacks identified by Contrast ADR and correlates them with WAF/DLP logs. This rule identifies critical database security breaches that have bypassed initial defenses and may result in data exfiltration or unauthorized database access.'
severity: High
status: Available
requiredDataConnectors:
- connectorId: ContrastADRCCF
dataTypes:
- ContrastADRAttackEvents_CL
queryFrequency: 5m
queryPeriod: 5m
triggerOperator: gt
triggerThreshold: 0
tactics:
- InitialAccess
- CredentialAccess
- Collection
- Exfiltration
- CommandAndControl
- Reconnaissance
- CredentialAccess
- LateralMovement
- Discovery
relevantTechniques:
- T1190
- T1552
- T1005
- T1041
- T1008
- T1590
- T1571
- T1528
- T1021
- T1046
query: |
ContrastADRAttackEvents_CL
| where result =~ "EXPLOITED" and rule =~ "SQL-INJECTION"
| project-rename hostname = host_hostname
//please add your DLP logs table in place of ContrastWAFLogs_CL and hostname colomun in place of hostname below and uncomment the queries below
//| join kind= inner (ContrastWAFLogs_CL | where TimeGenerated >= ago(5m)) on hostname
entityMappings:
- entityType: IP
fieldMappings:
- identifier: Address
columnName: sourceIp
- entityType: Host
fieldMappings:
- identifier: HostName
columnName: hostname
alertDetailsOverride:
alertDisplayNameFormat: 'Confirmed active SQL Injection by Contrast ADR on {{request_headers_referer}} endpoint of {{application_name}} '
alertDescriptionFormat: 'Confirmed active SQL Injection by Contrast ADR on {{request_headers_referer}} endpoint of {{application_name}} '
incidentConfiguration:
createIncident: true
groupingConfiguration:
enabled: true
reopenClosedIncident: false
lookbackDuration: PT30M
matchingMethod: Selected
groupByEntities:
- Host
- IP
eventGroupingSettings:
aggregationKind: AlertPerResult
kind: Scheduled
version: 1.0.1
Stages and Predicates
Stage 1: source
ContrastADRAttackEvents_CL
Stage 2: where
| where result =~ "EXPLOITED" and rule =~ "SQL-INJECTION"
Stage 3: project-rename
| project-rename hostname = host_hostname
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
Output fields
Fields the rule emits when it matches. Chronicle authors list these in the outcome block; they appear on the detection and $risk_score drives alerting. Sentinel / Defender XDR rules build them up through project / summarize / extend stages. Sentinel maps these into alert fields via entityMappings and customDetails; Defender XDR custom detections surface them as alert fields directly.
| Field | Source |
|---|---|
hostname | project-rename |