Rule History

alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SERVER Possible Attempt to Get SQL Server Version in URI using SELECT VERSION"; flow:established,to_server; http.uri; content:"SELECT"; nocase; content:"VERSION"; nocase; distance:1; reference:url,support.microsoft.com/kb/321185; classtype:web-application-attack; sid:2011037; rev:6; metadata:created_at 2010_07_30, confidence Medium, signature_severity Minor, updated_at 2020_08_20;)