Query: cross_site_scripting_javascript_uri

select
  tp_timestamp as timestamp,
  request_method as operation,
  request_uri as resource,
  status,
  http_user_agent as actor,
  tp_source_ip as source_ip,
  tp_id as source_id,
  -- Create new aliases to preserve original row data
  status as status_src,
  timestamp as timestamp_src,
  * exclude (status, timestamp)
from
  apache_access_log
where
  (
    request_uri is not null
    and (
      -- JavaScript URI schemes
      request_uri ilike '%javascript:%'
      or request_uri ilike '%vbscript:%' -- Obfuscated javascript: URIs
      or request_uri ilike '%jav
ascript:%'
      or request_uri ilike '%javascript:url(%'
    )
  )
  or (
    http_user_agent is not null
    and (
      -- JavaScript URI schemes
      http_user_agent ilike '%javascript:%'
      or http_user_agent ilike '%vbscript:%' -- Obfuscated javascript: URIs
      or http_user_agent ilike '%jav
ascript:%'
      or http_user_agent ilike '%javascript:url(%'
    )
  )
order by
  tp_timestamp desc;