SigmaHQ/rules/web/web_multiple_suspicious_resp_codes_single_source.yml

title: Multiple suspicious Response Codes caused by Single Client
description: Detects possible exploitation activity or bugs in a web application
author: Thomas Patzke
logsource:
    category: webserver
detection:
    selection:
        response:
          - 400
          - 401
          - 403
          - 500
    timeframe: 10m
    condition: selection | count() by clientip > 10
fields:
    - client_ip
    - vhost
    - url
    - response
falsepositives:
    - Unstable application
    - Application that misuses the response codes
level: medium
Added 'multiple_suspicious_response_codes_single_source' web rule 2017-01-10 23:39:26 +00:00			`title: Multiple suspicious Response Codes caused by Single Client`
			`description: Detects possible exploitation activity or bugs in a web application`
Added "logsource" sections and new rule 2017-02-18 23:31:59 +00:00			`author: Thomas Patzke`
			`logsource:`
Fixed rules * Replaced unspecified logsource attribute 'type' with 'category' * Usage of service 'auth' for linux logs 2017-09-10 22:35:52 +00:00			`category: webserver`
Added 'multiple_suspicious_response_codes_single_source' web rule 2017-01-10 23:39:26 +00:00			`detection:`
			`selection:`
Rule review and cleanup * removed unnecessary one element lists from definitions * converted some lists of one element maps to maps because the resulting OR linkage would cause wrong result. 2017-02-15 22:53:08 +00:00			`response:`
			`- 400`
			`- 401`
			`- 403`
			`- 500`
Bugfix: Added time frame to correlation rule 2017-03-12 16:11:29 +00:00			`timeframe: 10m`
Added 'multiple_suspicious_response_codes_single_source' web rule 2017-01-10 23:39:26 +00:00			`condition: selection \| count() by clientip > 10`
Added field names to first rules 2017-09-12 21:54:04 +00:00			`fields:`
			`- client_ip`
Added vhost field to web rules 2017-09-16 22:20:17 +00:00			`- vhost`
Added field names to first rules 2017-09-12 21:54:04 +00:00			`- url`
			`- response`
Added 'multiple_suspicious_response_codes_single_source' web rule 2017-01-10 23:39:26 +00:00			`falsepositives:`
			`- Unstable application`
			`- Application that misuses the response codes`
Levels to low, medium, high, critical 2017-02-16 17:02:26 +00:00			`level: medium`