Exploit succeeded
Flags a web-application attack that the server did NOT reject — an injection, traversal, web-shell, or Log4Shell request that returned a 2xx or a 5xx…
What it detects
Flags a web-application attack that the server did NOT reject — an injection, traversal, web-shell, or Log4Shell request that returned a 2xx or a 5xx instead of a 4xx block. A served response (200) or a triggered error (500) to a hostile request is a strong indicator the exploit reached the application, so this is a higher-severity companion to web.attack.suspicious_request (which flags the attempt regardless of outcome). Uses the parsed HTTP status, so it needs the web access-log parser.
MITRE ATT&CK mapping
False positives and triage
A 200 can also mean the app returned a generic page and the payload did nothing, and a WAF may pass the request through while the app sanitizes it. Confirm by reviewing the response size and the actual application behavior. Sanctioned pentests trip this by design.
The rule
Declarative YAML read by the detection engine — data, never executed. Confidence 75%. Source: rules/web/exploit_succeeded.yaml, licensed under the Apache License 2.0.
id: web.attack.exploit_succeeded
version: 1.1.0
status: stable
severity: critical
confidence: 0.75
platforms: [windows, linux, macos]
mitre_techniques: [T1190, T1505.003]
description: |
Flags a web-application attack that the server did NOT reject — an injection,
traversal, web-shell, or Log4Shell request that returned a 2xx or a 5xx instead
of a 4xx block. A served response (200) or a triggered error (500) to a hostile
request is a strong indicator the exploit reached the application, so this is a
higher-severity companion to `web.attack.suspicious_request` (which flags the
attempt regardless of outcome). Uses the parsed HTTP status, so it needs the web
access-log parser.
match:
event_action: http_request
http_status_any: ["200", "201", "500"]
raw_message_contains_any:
- "union select"
- "information_schema"
- "/etc/passwd"
- "/etc/shadow"
- "../../"
- "..%2f"
- "<?php"
- "base64_decode("
- "${jndi:"
- "() { :;};"
- "c99.php"
- "r57.php"
correlation_keys: [hostname]
false_positive_guidance: |
A 200 can also mean the app returned a generic page and the payload did nothing, and
a WAF may pass the request through while the app sanitizes it. Confirm by reviewing the
response size and the actual application behavior. Sanctioned pentests trip this by design.
Related detections
Run this rule on your own logs — offline
KIROSEC runs this rule and the rest of the library over Windows, Linux, macOS and cloud audit logs on the analyst's own machine. Every alert links to the events that raised it, and nothing leaves the device.