Detecting Vulnerability Scanning Traffic From Underground Tools Using Machine Learning

Palo Alto Networks Unit 42 analyzed a privately distributed SQL injection scanner named Swiss Army Suite (S.A.S) used by attackers to discover SQLi vulnerabilities at scale; the report covers unique ML detection triggers, Google-cache evidence of widespread scanning, telemetry-based geolocation of source IPs, a DVWA proof-of-concept, tool feature/configuration analysis (including proxy support and dorking), and provides sample hashes and mitigation guidance for defenders.