Catalogue
ATT&CK

Detection catalogue

Explore published rules with transparent provenance, licensing, and ATT&CK mappings.

detections

Search detections

Filters

Loading detections…

Loading detections

The public catalogue of detection rules. Every entry carries its source, the identifier it had there, its licence and its ATT&CK mapping.

Product

Catalogue ATT&CK Create a workspace

Trust

Security Privacy Licences Terms

Contact

Report a vulnerability Report a content issue contacto@detections.app

HighElastic detection rules

Web Server Potential SQL Injection Request

This rule detects potential SQL injection attempts in web server requests by identifying common SQL injection patterns in URLs. Such activity may indicate reconnaissance or exploitation attempts by attackers trying to manipulate backend databases or extract sensitive information.

ATT&CK coverage

Reconnaissance

T1595Active Scanning31 detections cover this technique
- T1595.002Vulnerability Scanning 13 detections cover this technique
- T1595.003Wordlist Scanning 9 detections cover this technique

Initial Access

T1190Exploit Public-Facing Application 216 detections cover this technique

Execution

T1059Command and Scripting Interpreter450 detections cover this technique
- T1059.004Unix Shell 187 detections cover this technique

Persistence

T1505Server Software Component 35 detections cover this technique

Command and Control

T1071Application Layer Protocol 112 detections cover this technique

Detection requirements

Log source category: event_index

Detection logic

Published to signed-in readers

The query as its source wrote it, its canonical form, and the content hash that pins this exact revision.

Provenance

Where this detection came from, and what you may do with it.

At source: Open at source
Written by: Elastic
Licence: Elastic License 2.0Read the licence
Published: Aug 27, 2026
Version: 1