diff --git a/java/lang/security/audit/sqli/hibernate-sqli.java b/java/lang/security/audit/sqli/hibernate-sqli.java
index cfe4968b59..3342079469 100644
--- a/java/lang/security/audit/sqli/hibernate-sqli.java
+++ b/java/lang/security/audit/sqli/hibernate-sqli.java
@@ -2,6 +2,7 @@
 
 import org.hibernate.Criteria;
 import org.hibernate.Session;
+import org.hibernate.SharedSessionContract;
 import org.hibernate.SessionFactory;
 import org.hibernate.criterion.Restrictions;
 import org.hibernate.type.StandardBasicTypes;
@@ -43,4 +44,14 @@ public void testQueries(SessionFactory sessionFactory, String input) {
         criteria.add(Restrictions.sqlRestriction("param1  = ? and param2 = ?", new String[] {input}, new Type[] {StandardBasicTypes.STRING}));
 
     }
+
+    public void testSharedSessionContract(SessionFactory sessionFactory, String input) {
+        SharedSessionContract session = sessionFactory.openSession();
+        String hql = "from UserEntity where name = '" + input + "'";
+        // ruleid: hibernate-sqli
+        session.createQuery(hql);
+
+        // ok: hibernate-sqli
+        session.createQuery("from UserEntity");
+    }
 }
diff --git a/java/lang/security/audit/sqli/hibernate-sqli.yaml b/java/lang/security/audit/sqli/hibernate-sqli.yaml
index 91d58cd0c9..a6820513d2 100644
--- a/java/lang/security/audit/sqli/hibernate-sqli.yaml
+++ b/java/lang/security/audit/sqli/hibernate-sqli.yaml
@@ -47,10 +47,17 @@ rules:
       - pattern-inside: |
           org.hibernate.Session $SESSION = ...;
           ...
+      - pattern-inside: |
+          org.hibernate.SharedSessionContract $SESSION = ...;
+          ...
       - pattern-inside: |
           $TYPE $FUNC(...,org.hibernate.Session $SESSION,...) {
             ...
           }
+      - pattern-inside: |
+          $TYPE $FUNC(...,org.hibernate.SharedSessionContract $SESSION,...) {
+            ...
+          }
     - pattern-not: |
         $SESSION.$METHOD("..." + "...",...);
     - metavariable-regex: