SQLMap Automated Scanner Detected

Darshan Thummar@Mighty

•updated Jun 10, 2026•0•0•2

This rule detects the use of the SQLMap automated SQL injection tool by identifying the string "sqlmap" in the HTTP User-Agent header of network traffic. It specifically looks for traffic flowing to the server on established connections.