Suspicious request
Detects web-application attack patterns in HTTP request logs — SQL injection, cross-site scripting (XSS), path traversal / local file inclusion…
What it detects
Detects web-application attack patterns in HTTP request logs — SQL injection, cross-site scripting (XSS), path traversal / local file inclusion, web-shell interaction, OS-command / Log4Shell injection, and known vulnerability-scanner user-agents. Matches (case-insensitively) against the raw request line, so it works on any imported web/proxy access log (Apache/Nginx combined, IIS) without a dedicated parser. High-signal strings only, to stay clear of ordinary endpoint logs.
MITRE ATT&CK mapping
False positives and triage
WAF logs, scanners you operate, and pages that legitimately contain these strings can match. Confirm the source IP, the HTTP response code (a 200 on an injection attempt is far worse than a 403/404), and whether a real endpoint was hit. Sanctioned pentests and DAST scans trip this by design — scope them to the engagement.
The rule
Declarative YAML read by the detection engine — data, never executed. Confidence 70%. Source: rules/web/web_attack_request.yaml, licensed under the Apache License 2.0.
id: web.attack.suspicious_request
version: 1.2.0
status: stable
severity: high
confidence: 0.7
platforms: [windows, linux, macos]
mitre_techniques: [T1190, T1505.003]
description: |
Detects web-application attack patterns in HTTP request logs — SQL injection,
cross-site scripting (XSS), path traversal / local file inclusion, web-shell
interaction, OS-command / Log4Shell injection, and known vulnerability-scanner
user-agents. Matches (case-insensitively) against the raw request line, so it works
on any imported web/proxy access log (Apache/Nginx combined, IIS) without a dedicated
parser. High-signal strings only, to stay clear of ordinary endpoint logs.
match:
raw_message_contains_any:
# SQL injection
- "union select"
- "' or '1'='1"
- " or 1=1--"
- "information_schema"
- "waitfor delay"
# Cross-site scripting (XSS) — reflected / stored payloads in the request line
- "<script"
- "%3cscript"
- "javascript:"
- "onerror="
- "onmouseover="
- "document.cookie"
# Path traversal / local file inclusion
- "../../"
- "..%2f"
- "..%5c"
- "/etc/passwd"
- "/etc/shadow"
- "boot.ini"
# Web shells / code execution
- "<?php"
- "base64_decode("
- "c99.php"
- "r57.php"
- "eval(base64"
# OS command / Log4Shell injection
- "${jndi:"
- "() { :;};"
# Known vulnerability scanners
- "sqlmap"
- "acunetix"
- "nikto/"
correlation_keys: [hostname]
false_positive_guidance: |
WAF logs, scanners you operate, and pages that legitimately contain these strings can
match. Confirm the source IP, the HTTP response code (a 200 on an injection attempt is far
worse than a 403/404), and whether a real endpoint was hit. Sanctioned pentests and
DAST scans trip this by design — scope them to the engagement.
Related detections
Run this rule on your own logs — offline
KIROSEC runs this rule and the rest of the library over Windows, Linux, macOS and cloud audit logs on the analyst's own machine. Every alert links to the events that raised it, and nothing leaves the device.