AVideo Unauthenticated SQL Injection & Metasploit Persistence Modules: Detection & Response

---
title: AVideo Potential SQL Injection Attempt
id: 9a8b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects potential SQL injection attempts against AVideo web interfaces based on common SQLi patterns found in Metasploit modules.
references:
  - https://www.rapid7.com/blog/post/pt-metasploit-wrap-up-04-17-2026
author: Security Arsenal
date: 2026/04/17
tags:
  - attack.initial_access
  - attack.t1190
  - attack.web_shell
logsource:
  category: web
detection:
  selection_uri:
  - cs-uri-query|contains:
    - 'UNION SELECT'
    - 'OR 1=1'
    - 'AND 1=1'
    - 'order by'
    - 'concat('
  selection_target:
    cs-uri-stem|contains:
    - '/video'
    - '/avideo'
    - '/view'
  condition: selection_uri and selection_target
falsepositives:
  - Valid application testing (rare for these patterns)
level: high
---
title: Suspicious PowerShell Profile Modification
id: b1c2d3e4-f5a6-7890-1234-567890abcdef
status: experimental
description: Detects modification of PowerShell profile files which can be used for persistence.
references:
  - https://attack.mitre.org/techniques/T1546/013/
author: Security Arsenal
date: 2026/04/17
tags:
  - attack.persistence
  - attack.t1546.013
logsource:
  category: file_change
  product: windows
detection:
  selection:
    TargetFilename|contains:
      - '\\Microsoft.Windows.PowerShell_profile.ps1'
      - '\\Profile.ps1'
  filter:
    Image|endswith:
      - '\\powershell.exe'
      - '\\code.exe'
      - '\
otepad.exe'
  condition: selection
falsepositives:
  - Administrators legitimately customizing their profiles
level: medium

// Hunt for AVideo SQLi patterns in Web Logs (CommonSecurityLog or W3CIISLog)
// Look for typical injection strings targeting the application
let sqli_keywords = dynamic([\"UNION SELECT\", \"ORDER BY 1--\", \"concat(0x\", \"information_schema\", \"waitfor delay\"]);
CommonSecurityLog
| where RequestURL contains \"video\" or RequestURL contains \"avideo\"
| where RequestURL has_any (sqli_keywords) or RequestPayload has_any (sqli_keywords)
| project TimeGenerated, DeviceName, SourceIP, RequestURL, RequestPayload, DestinationPort
| summarize count() by bin(TimeGenerated, 1h), SourceIP, RequestURL
| where count_ > 5


// Hunt for BITS Admin usage for persistence
// Malicious actors use bitsadmin to create jobs that execute payloads
DeviceProcessEvents
| where FileName =~ \"bitsadmin.exe\"
| where ProcessCommandLine has \"addfile\" or ProcessCommandLine has \"SetNotifyCmdLine\" or ProcessCommandLine has \"SetNotifyFlags\"
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName
| order by Timestamp desc

-- Hunt for AVideo configuration disclosure or Webshells
-- AVideo often installs in /var/www/html/avideo or similar
-- This hunt looks for common webshells or suspicious PHP files in the webroot
SELECT FullPath, Size, Mtime, Mode
FROM glob(globs='/var/www/html/**/*.php')
WHERE Mode.IsExecutable
  AND (
    -- Look for recently modified PHP files (last 7 days)
    Mtime > now(epoch=true) - 604800
    -- Or common obfuscation patterns in filenames (heuristic)
    OR Name =~ 'shell'
    OR Name =~ 'upload'
    OR Name =~ 'cmd'
  )
LIMIT 50

#!/bin/bash
# AVideo Hardening and Log Check Script
# This script checks for evidence of SQLi attempts in logs and verifies permissions.

# Check if AVideo is installed and get path
AVIDEO_PATH=$(find /var/www/html -type d -name \"avideo\" 2>/dev/null | head -n 1)

if [ -n \"$AVIDEO_PATH\" ]; then
    echo \"[+] AVideo installation found at: $AVIDEO_PATH\"

    # Check for common SQLi signatures in Apache/Nginx logs (last 24 hours)
    LOG_DIR=\"/var/log\"
    echo \"[*] Scanning for SQL injection attempts in logs...\"

    # Grep for SQLi patterns (heuristic)
    grep -E \"UNION.*SELECT|ORDER BY.*[0-9]--|information_schema\" $(find $LOG_DIR -name \"access.log\" -o -name \"access.log.*\" -mtime -1) 2>/dev/null | tail -n 20

    if [ $? -eq 0 ]; then
        echo \"[!] WARNING: Potential SQLi patterns found in logs. Review above output.\"
    else
        echo \"[+] No obvious SQLi patterns found in recent logs.\"
    fi

    # Ensure config files are not world-readable (if sensitive info resides there)
    echo \"[*] Checking configuration permissions...\"
    find \"$AVIDEO_PATH\" -name \"config.php\" -o -name \"*.ini\" | while read file; do
        perms=$(stat -c %a \"$file\")\        if [ \"$perms\" != \"600\" ] && [ \"$perms\" != \"640\" ]; then
            echo \"[!] Insecure permissions on $file: $perms\"
        fi
    done
else
    echo \"[-] AVideo installation not found in /var/www/html.\"
fi

echo \"[*] Remind: Apply the latest vendor patches for AVideo immediately.\"