✏ EDIT: 942190.ra##! Please refer to the documentation at
##! https://coreruleset.org/docs/development/regex_assembly/.

##!+ i

##!> define quotes [\"'`]

##!> assemble
  {{quotes}}
  ##!=>
  \s*!\s*[\"'`\w]
  ##!> assemble
    ;?\s*
    ##!=>
    having
    select
    ##!> assemble
      union\b\s*
      ##!=>
      all
      distinct
      select
    ##!<
    ##!=>
    \b\s*[^\s]
  ##!<
##!<

##!> assemble
  \b
  ##!=>
  ##!> assemble
    connection_id
    current_user
    database
    schema
    user
    ##!=>
    \s*?\(
  ##!<

  exec\s+master\.
  execute\s+master\.
  from\W+information_schema\W
  ##!> assemble
    into[\s+]+
    ##!=>
    dumpfile
    outfile
    ##!=>
    \s*?{{quotes}}
  ##!<

  select.*?\w?user\(
  union\sselect\s@
  union[\w(\s]*?select
##!<

\s*?exec.*?\Wxp_cmdshell
\s*?execute.*?\Wxp_cmdshell
\Wiif\s*?\(


 [✗] CANCEL

[~] Kerym Chaeceran