04 — Detection Coverage: WAF Rules & Monitoring

SQL Injection Detection Signatures

Web Application Firewall (WAF) Rules

ModSecurity Rule (OWASP CRS):

SecRule ARGS "(?:union|select|insert|update|delete|drop|create|alter|exec|execute|script|onclick|javascript:|onerror:)" "@rx" \
    "id:100001,phase:2,deny,status:403,msg:'SQL Injection Attack Detected'"

SecRule ARGS "('|(and|or)\s+(1|0)\s*=)" "@rx" \
    "id:100002,phase:2,deny,status:403,msg:'SQL Injection - Boolean Logic Detected'"

Cloudflare WAF Rules: - XSS/SQLi/Command Injection (managed) - Custom rule: Block requests with SQL keywords + quotes - Rate limiting: Detect automated injection attempts

Detection Analytics (CAR-equivalent)

Detection	Trigger	Accuracy
Failed Login Attempts	>5 failed logins in 5 min	High
Database Error Messages	SQL error in HTTP response	High
Unusual Query Patterns	UNION, WAITFOR, SLEEP in logs	Medium-High
Data Extraction Volume	Abnormally large result sets	Medium
Admin Account Creation	New admin user in logs	High
Table Structure Queries	information_schema queries	High

SIEM Detection Queries

Splunk

index=web_application_firewalls
  (sql_injection OR sqli_attempt OR detected_injection)
| stats count by src_ip, uri_path, action
| where count > 5

Elasticsearch

{
  "query": {
    "bool": {
      "should": [
        {"match": {"request_body": "UNION"}},
        {"match": {"request_body": "WAITFOR"}},
        {"match": {"status_code": "500"}}
      ]
    }
  }
}

Database Activity Monitoring

MySQL Query Log Analysis

# Enable query logging (performance impact)
SET GLOBAL general_log = 'ON';

# Monitor for suspicious patterns
grep -i "union\|select.*from.*where\|drop\|delete" /var/log/mysql/general.log

Log Pattern Examples (Malicious)

Query_time: 0.5  Lock_time: 0  Rows_sent: 500000  Rows_examined: 500000
SELECT * FROM users UNION SELECT username,password FROM admin_users

Query_time: 5.2  Lock_time: 0  Rows_sent: 1  Rows_examined: 1
SELECT * FROM products WHERE id=1 WAITFOR DELAY '00:00:05'

Query_time: 0.001  Lock_time: 0  Rows_sent: 0  Rows_examined: 0
DELETE FROM logs WHERE id > 0

Network-Based Detection

IDS/IPS Signatures

Snort rule:

alert http any any -> any any (msg:"SQL Injection Attempt"; \
  uricontent:"?"; pcre:"/(\bUNION\b.*\bSELECT\b|\bSELECT\b.*\bFROM\b|\bINSERT\b.*\bVALUES\b)/i"; \
  sid:3000001; rev:1;)

Time-based detection:

import time
import requests

# Test endpoint
url = "http://vulnerable.com/search?q="

# Normal request time
normal_time = time.time()
requests.get(url + "shoes")
normal_latency = time.time() - normal_time

# SQLi with SLEEP injection
injection_time = time.time()
requests.get(url + "shoes' AND SLEEP(5) --")
injection_latency = time.time() - injection_time

if injection_latency > (normal_latency + 4):
    print("Blind SQL Injection detected!")

KGCS Documentation