ET SCAN Possible SQLMAP Scan

Query · suricata

flow:established,to_server;
http.uri;
content:"UNION ALL SELECT NULL, NULL, NULL, NULL";
content:"-- AND";
detection_filter:track by_dst, count 4, seconds 20;
Raw source ET SCAN Possible SQLMAP Scan · Suricata
Esc
Published by Emerging Threats Open ↗, licensed under BSD 3-Clause ↗. Line breaks added for readability; the rule is otherwise unchanged. 
alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (
    msg:"ET SCAN Possible SQLMAP Scan";
    flow:established,to_server;
    http.uri;
    content:"UNION ALL SELECT NULL, NULL, NULL, NULL";
    content:"-- AND";
    detection_filter:track by_dst, count 4, seconds 20;
    reference:url,sqlmap.sourceforge.net;
    reference:url,www.darknet.org.uk/2011/04/sqlmap-0-9-released-automatic-blind-sql-injection-tool/;
    classtype:attempted-recon;
    sid:2012754; rev:3;
    metadata:created_at 2011_04_29, confidence Medium, signature_severity Informational, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2020_04_20;
)

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.