sqlmap
MITRE ATT&CK: S0225 View on attack.mitre.org
Aliases: sqlmap
- First seen
- 2009-06-01 00:00:00
- Malware type
- exploit-kit
- Last IoC activity
- 2026-07-15 16:45:04
- Profile updated
- 2026-07-07 15:33:05
Context
sqlmap is an open source penetration testing tool that can be used to automate the process of detecting and exploiting SQL injection flaws.
Detection coverage
- 46 Sigma rules
Malware & tools used
- Exploit Public-Facing Application (attack-pattern)
Used by threat actors
- Operation Digital Eye (campaign)
- Ajax Security Team (threat-actor)
- APT41 (threat-actor)
Reports & references
- sqlmap.org (report)
- MITRE ATT&CK — S0225 (report)