Detection catalogue

Explore published rules with transparent provenance, licensing, and ATT&CK mappings.

detections

Loading detections…

Boolean Blind SQL Injection

This hunting query will detect instances where a balanced boolean query, e.g. "true=true", is observed in an SQL query sent to the server. Balanced boolean queries are commonly used by attackers to test of SQL injections vulnerabilities

ATT&CK coverage

Initial Access

T1190Exploit Public-Facing Application 342 detections cover this technique

Detection requirements

Log source product: azuresql
Log source service: azurediagnostics

What the source says

Tagged by the source as

InitialAccess

Detection logic

Published to signed-in readers

The query as its source wrote it, its canonical form, and the content hash that pins this exact revision.