SignalHunt
← All rules

WAF-5001

high

SQL Injection Attempt Blocked

Detects a WAF signature match and block for a SQL injection pattern (e.g. UNION SELECT, tautology-based auth bypass) against a web application.

T1190

Detection logic

{
  "detection_type": "selection",
  "selection": {
    "action": "block",
    "attack_type": "sqli"
  }
}

Log source: category=waf · Event ID(s): waf_block

Required log fields

  • src_ip
  • uri
  • matched_rule

Enabling this in your environment

Where: WAF (ModSecurity/AWS WAF/Cloudflare WAF) - ensure SQLi rule group is enabled in blocking (not just detection/log) mode, and that blocked requests are shipped to your log pipeline.

aws wafv2 update-web-acl --rules '[{"Name":"AWSManagedRulesSQLiRuleSet",...}]'

Many WAF deployments start SQLi rule groups in "count" (log-only) mode to avoid breaking legitimate traffic during tuning - confirm the rule group is actually set to Block before relying on this detection meaning an attack was stopped.

False positives

  • Rare - legitimate application traffic almost never contains SQL syntax in request parameters; a spike may indicate an overly broad signature rather than a real false positive

References