[C언어] Data Conversion Tool - RawVera : sigma_ips.yml

sigma_ips.yml

0.00MB

title: IPS 탐지이벤트명 기반 SQL 인젝션 공격 탐지
id: 9b1deb4d-3b7d-4bad-9bdd-e3d489cd3632
status: experimental
description: IPS 장비의 탐지이벤트명에 sql 또는 sqli 키워드가 포함된 이벤트를 탐지합니다.
author: CERT_User
date: 2026/05/21
tags:
    - attack.initial-access
    - attack.t1059.003
logsource:
    category: network
    product: ips
detection:
    selection:
        signature|contains:
            - 'sql'
            - 'sqli'
    condition: selection
level: medium

 

 

log_ips.log

0.00MB

 

[
  {
    "_product": "Generic IPS",
    "_category": "ids",
    "timestamp": "2026-05-21T14:50:01Z",
    "signature": "Web-Attack: SQL Injection Attempt in HTTP POST Body",
    "payload": "username=admin' OR '1'='1"
  }
]