Query: sql_injection_user_agent_based

select
  tp_timestamp as timestamp,
request_method as operation,
request_uri as resource,
status,
http_user_agent as actor,
tp_source_ip as source_ip,
tp_id as source_id,
-- Create new aliases to preserve original row data
status as status_src,
timestamp as timestamp_src,
*
exclude (status, timestamp)

from
  apache_access_log
where
  http_user_agent is not null
  and (
    -- Basic SQL injection patterns in User-Agent
    http_user_agent ilike '%select%from%'
    or http_user_agent ilike '%union%select%'
    or http_user_agent ilike '%insert%into%'
    or http_user_agent ilike '%update%set%'
    or http_user_agent ilike '%delete%from%'
    or http_user_agent ilike '%drop%table%'
    -- Common SQL comment markers and logic patterns
    or http_user_agent ilike '%/*_%*/%'
    or http_user_agent ilike '%--+%'
    or http_user_agent ilike '%-- %'
    or http_user_agent ilike '%;--%'
    or http_user_agent ilike '%or%1=1%'
    or http_user_agent ilike '%or%true%'
    -- Database-specific User-Agent attacks
    or http_user_agent ilike '%@@version%'
    or http_user_agent ilike '%information_schema%'
    or http_user_agent ilike '%sql_injectionte_master%'
    or http_user_agent ilike '%pg_tables%'
    or http_user_agent ilike '%sys.%'
    -- Time-based techniques
    or http_user_agent ilike '%sleep(%'
    or http_user_agent ilike '%benchmark(%'
    or http_user_agent ilike '%pg_sleep(%'
    or http_user_agent ilike '%waitfor%delay%'
  )
order by
  tp_timestamp desc;