SigmaHQ/rules/web/web_multiple_suspicious_resp_codes_single_source.yml

title: Multiple Suspicious Resp Codes Caused by Single Client
id: 6fdfc796-06b3-46e8-af08-58f3505318af
status: experimental
description: Detects possible exploitation activity or bugs in a web application
author: Thomas Patzke
date: 2017/02/19
modified: 2020/09/03
logsource:
    category: webserver
detection:
    selection:
        sc-status:
          - 400
          - 401
          - 403
          - 500
    timeframe: 10m
    condition: selection | count() by clientip > 10
fields:
    - client_ip
    - vhost
    - url
    - response
falsepositives:
    - Unstable application
    - Application that misuses the response codes
level: medium
tags:
    - attack.initial_access
    - attack.t1190
fix: fixed casing and long rule titles 2020-01-30 16:26:09 +00:00			`title: Multiple Suspicious Resp Codes Caused by Single Client`
Added UUIDs to rules 2019-11-12 22:12:27 +00:00			`id: 6fdfc796-06b3-46e8-af08-58f3505318af`
Second round 2020-09-15 13:02:30 +00:00			`status: experimental`
Added 'multiple_suspicious_response_codes_single_source' web rule 2017-01-10 23:39:26 +00:00			`description: Detects possible exploitation activity or bugs in a web application`
Added "logsource" sections and new rule 2017-02-18 23:31:59 +00:00			`author: Thomas Patzke`
fix: fixed missing date fields in other files 2020-01-30 14:32:39 +00:00			`date: 2017/02/19`
att&ck tags review: web, network/zeek 2020-09-03 14:04:57 +00:00			`modified: 2020/09/03`
Added "logsource" sections and new rule 2017-02-18 23:31:59 +00:00			`logsource:`
Fixed rules * Replaced unspecified logsource attribute 'type' with 'category' * Usage of service 'auth' for linux logs 2017-09-10 22:35:52 +00:00			`category: webserver`
Added 'multiple_suspicious_response_codes_single_source' web rule 2017-01-10 23:39:26 +00:00			`detection:`
			`selection:`
use the taxonomy for http response which is `sc-status` 2020-03-14 19:02:33 +00:00			`sc-status:`
Rule review and cleanup * removed unnecessary one element lists from definitions * converted some lists of one element maps to maps because the resulting OR linkage would cause wrong result. 2017-02-15 22:53:08 +00:00			`- 400`
			`- 401`
			`- 403`
			`- 500`
Bugfix: Added time frame to correlation rule 2017-03-12 16:11:29 +00:00			`timeframe: 10m`
Added 'multiple_suspicious_response_codes_single_source' web rule 2017-01-10 23:39:26 +00:00			`condition: selection \| count() by clientip > 10`
Added field names to first rules 2017-09-12 21:54:04 +00:00			`fields:`
			`- client_ip`
Added vhost field to web rules 2017-09-16 22:20:17 +00:00			`- vhost`
Added field names to first rules 2017-09-12 21:54:04 +00:00			`- url`
			`- response`
Added 'multiple_suspicious_response_codes_single_source' web rule 2017-01-10 23:39:26 +00:00			`falsepositives:`
			`- Unstable application`
			`- Application that misuses the response codes`
Levels to low, medium, high, critical 2017-02-16 17:02:26 +00:00			`level: medium`
Second round 2020-09-15 13:02:30 +00:00			`tags:`
			`- attack.initial_access`
			`- attack.t1190`