admin/elastic-detection-rules
1
0
Fork 0
mirror of https://github.com/elastic/detection-rules synced 2026-06-08 14:00:08 +00:00
Code Issues Packages Projects Releases Wiki Activity

[Rule Tunings] Misc. Web Server Rules (#5384)

Browse Source 
(cherry picked from commit e19ce18a40)
This commit is contained in:
Ruben Groenewoud
2025-12-02 09:21:16 +01:00
committed by tradebot-elastic
parent 3b59d4d9c4
commit cdafa9268f
5 changed files with 68 additions and 87 deletions
Download Patch File Download Diff File Expand all files Collapse all files
rules/cross-platform/persistence_web_server_potential_command_injection.toml
+18 -22
View File
@@ -1,8 +1,8 @@
[metadata]
creation_date = "2025/11/19"
integration = ["nginx", "apache", "apache_tomcat", "iis", "network_traffic"]
integration = ["nginx", "apache", "apache_tomcat", "iis"]
maturity = "production"
updated_date = "2025/11/24"
updated_date = "2025/12/01"
[rule]
author = ["Elastic"]
@@ -54,14 +54,12 @@ rule_id = "f3ac6734-7e52-4a0d-90b7-6847bf4308f2"
severity = "low"
tags = [
"Domain: Web",
"Domain: Network",
"Use Case: Threat Detection",
"Tactic: Reconnaissance",
"Tactic: Persistence",
"Tactic: Execution",
"Tactic: Credential Access",
"Tactic: Command and Control",
"Data Source: Network Packet Capture",
"Data Source: Nginx",
"Data Source: Apache",
"Data Source: Apache Tomcat",
@@ -71,26 +69,24 @@ tags = [
timestamp_override = "event.ingested"
type = "esql"
query = '''
from logs-network_traffic.http-*, logs-network_traffic.tls-*, logs-nginx.access-*, logs-apache.access-*, logs-apache_tomcat.access-*, logs-iis.access-*
from logs-nginx.access-*, logs-apache.access-*, logs-apache_tomcat.access-*, logs-iis.access-*
| where
(url.original is not null or url.full is not null) and
// Limit to 200 response code to reduce noise
http.response.status_code == 200
| eval Esql.url_lower = case(url.original is not null, url.original, url.full)
| eval Esql.url_lower = to_lower(Esql.url_lower)
| eval Esql.url_original_to_lower = to_lower(url.original)
| eval Esql.contains_interpreter = case(Esql.url_lower like "*python* -c*" or Esql.url_lower like "*perl* -e*" or Esql.url_lower like "*ruby* -e*" or Esql.url_lower like "*ruby* -rsocket*" or Esql.url_lower like "*lua* -e*" or Esql.url_lower like "*php* -r*" or Esql.url_lower like "*node* -e*", 1, 0)
| eval Esql.contains_shell = case(Esql.url_lower like "*/bin/bash*" or Esql.url_lower like "*bash*-c*" or Esql.url_lower like "*/bin/sh*" or Esql.url_lower rlike "*sh.{1,2}-c*", 1, 0)
| eval Esql.contains_nc = case(Esql.url_lower like "*netcat*" or Esql.url_lower like "*ncat*" or Esql.url_lower rlike """.*nc.{1,2}[0-9]{1,3}(\.[0-9]{1,3}){3}.{1,2}[0-9]{1,5}.*""" or Esql.url_lower like "*nc.openbsd*" or Esql.url_lower like "*nc.traditional*" or Esql.url_lower like "*socat*", 1, 0)
| eval Esql.contains_devtcp = case(Esql.url_lower like "*/dev/tcp/*" or Esql.url_lower like "*/dev/udp/*", 1, 0)
| eval Esql.contains_helpers = case((Esql.url_lower like "*/bin/*" or Esql.url_lower like "*/usr/bin/*") and (Esql.url_lower like "*mkfifo*" or Esql.url_lower like "*nohup*" or Esql.url_lower like "*setsid*" or Esql.url_lower like "*busybox*"), 1, 0)
| eval Esql.contains_sus_cli = case(Esql.url_lower like "*import*pty*spawn*" or Esql.url_lower like "*import*subprocess*call*" or Esql.url_lower like "*tcpsocket.new*" or Esql.url_lower like "*tcpsocket.open*" or Esql.url_lower like "*io.popen*" or Esql.url_lower like "*os.execute*" or Esql.url_lower like "*fsockopen*", 1, 0)
| eval Esql.contains_privileges = case(Esql.url_lower like "*chmod*+x", 1, 0)
| eval Esql.contains_downloader = case(Esql.url_lower like "*curl *" or Esql.url_lower like "*wget *" , 1, 0)
| eval Esql.contains_file_read_keywords = case(Esql.url_lower like "*/etc/shadow*" or Esql.url_lower like "*/etc/passwd*" or Esql.url_lower like "*/root/.ssh/*" or Esql.url_lower like "*/home/*/.ssh/*" or Esql.url_lower like "*~/.ssh/*" or Esql.url_lower like "*/proc/self/environ*", 1, 0)
| eval Esql.contains_base64_cmd = case(Esql.url_lower like "*base64*-d*" or Esql.url_lower like "*echo*|*base64*", 1, 0)
| eval Esql.contains_suspicious_path = case(Esql.url_lower like "*/tmp/*" or Esql.url_lower like "*/var/tmp/*" or Esql.url_lower like "*/dev/shm/*" or Esql.url_lower like "*/root/*" or Esql.url_lower like "*/home/*/*" or Esql.url_lower like "*/var/www/*" or Esql.url_lower like "*/etc/cron.*/*", 1, 0)
| eval Esql.contains_interpreter = case(Esql.url_original_to_lower like "*python* -c*" or Esql.url_original_to_lower like "*perl* -e*" or Esql.url_original_to_lower like "*ruby* -e*" or Esql.url_original_to_lower like "*ruby* -rsocket*" or Esql.url_original_to_lower like "*lua* -e*" or Esql.url_original_to_lower like "*php* -r*" or Esql.url_original_to_lower like "*node* -e*", 1, 0)
| eval Esql.contains_shell = case(Esql.url_original_to_lower like "*/bin/bash*" or Esql.url_original_to_lower like "*bash*-c*" or Esql.url_original_to_lower like "*/bin/sh*" or Esql.url_original_to_lower rlike "*sh.{1,2}-c*", 1, 0)
| eval Esql.contains_nc = case(Esql.url_original_to_lower like "*netcat*" or Esql.url_original_to_lower like "*ncat*" or Esql.url_original_to_lower rlike """.*nc.{1,2}[0-9]{1,3}(\.[0-9]{1,3}){3}.{1,2}[0-9]{1,5}.*""" or Esql.url_original_to_lower like "*nc.openbsd*" or Esql.url_original_to_lower like "*nc.traditional*" or Esql.url_original_to_lower like "*socat*", 1, 0)
| eval Esql.contains_devtcp = case(Esql.url_original_to_lower like "*/dev/tcp/*" or Esql.url_original_to_lower like "*/dev/udp/*", 1, 0)
| eval Esql.contains_helpers = case((Esql.url_original_to_lower like "*/bin/*" or Esql.url_original_to_lower like "*/usr/bin/*") and (Esql.url_original_to_lower like "*mkfifo*" or Esql.url_original_to_lower like "*nohup*" or Esql.url_original_to_lower like "*setsid*" or Esql.url_original_to_lower like "*busybox*"), 1, 0)
| eval Esql.contains_sus_cli = case(Esql.url_original_to_lower like "*import*pty*spawn*" or Esql.url_original_to_lower like "*import*subprocess*call*" or Esql.url_original_to_lower like "*tcpsocket.new*" or Esql.url_original_to_lower like "*tcpsocket.open*" or Esql.url_original_to_lower like "*io.popen*" or Esql.url_original_to_lower like "*os.execute*" or Esql.url_original_to_lower like "*fsockopen*", 1, 0)
| eval Esql.contains_privileges = case(Esql.url_original_to_lower like "*chmod*+x", 1, 0)
| eval Esql.contains_downloader = case(Esql.url_original_to_lower like "*curl *" or Esql.url_original_to_lower like "*wget *" , 1, 0)
| eval Esql.contains_file_read_keywords = case(Esql.url_original_to_lower like "*/etc/shadow*" or Esql.url_original_to_lower like "*/etc/passwd*" or Esql.url_original_to_lower like "*/root/.ssh/*" or Esql.url_original_to_lower like "*/home/*/.ssh/*" or Esql.url_original_to_lower like "*~/.ssh/*" or Esql.url_original_to_lower like "*/proc/self/environ*", 1, 0)
| eval Esql.contains_base64_cmd = case(Esql.url_original_to_lower like "*base64*-d*" or Esql.url_original_to_lower like "*echo*|*base64*", 1, 0)
| eval Esql.contains_suspicious_path = case(Esql.url_original_to_lower like "*/tmp/*" or Esql.url_original_to_lower like "*/var/tmp/*" or Esql.url_original_to_lower like "*/dev/shm/*" or Esql.url_original_to_lower like "*/root/*" or Esql.url_original_to_lower like "*/home/*/*" or Esql.url_original_to_lower like "*/var/www/*" or Esql.url_original_to_lower like "*/etc/cron.*/*", 1, 0)
| eval Esql.any_payload_keyword = case(
Esql.contains_interpreter == 1 or Esql.contains_shell == 1 or Esql.contains_nc == 1 or Esql.contains_devtcp == 1 or
@@ -99,7 +95,7 @@ from logs-network_traffic.http-*, logs-network_traffic.tls-*, logs-nginx.access-
| keep
@timestamp,
Esql.url_lower,
Esql.url_original_to_lower,
Esql.any_payload_keyword,
Esql.contains_interpreter,
Esql.contains_shell,
@@ -123,13 +119,13 @@ from logs-network_traffic.http-*, logs-network_traffic.tls-*, logs-nginx.access-
| stats
Esql.event_count = count(),
Esql.url_path_count_distinct = count_distinct(Esql.url_lower),
Esql.url_path_count_distinct = count_distinct(Esql.url_original_to_lower),
// General fields
Esql.host_name_values = values(host.name),
Esql.agent_id_values = values(agent.id),
Esql.url_path_values = values(Esql.url_lower),
Esql.url_path_values = values(Esql.url_original_to_lower),
Esql.http.response.status_code_values = values(http.response.status_code),
Esql.user_agent_original_values = values(user_agent.original),
Esql.event_dataset_values = values(event.dataset),
rules/cross-platform/reconnaissance_web_server_discovery_or_fuzzing_activity.toml
+8 -12
View File
@@ -1,8 +1,8 @@
[metadata]
creation_date = "2025/11/19"
integration = ["network_traffic", "nginx", "apache", "apache_tomcat", "iis"]
integration = ["nginx", "apache", "apache_tomcat", "iis"]
maturity = "production"
updated_date = "2025/11/24"
updated_date = "2025/12/01"
[rule]
author = ["Elastic"]
@@ -52,10 +52,8 @@ rule_id = "8383a8d0-008b-47a5-94e5-496629dc3590"
severity = "low"
tags = [
"Domain: Web",
"Domain: Network",
"Use Case: Threat Detection",
"Tactic: Reconnaissance",
"Data Source: Network Packet Capture",
"Data Source: Nginx",
"Data Source: Apache",
"Data Source: Apache Tomcat",
@@ -65,14 +63,12 @@ tags = [
timestamp_override = "event.ingested"
type = "esql"
query = '''
from logs-network_traffic.http-*, logs-network_traffic.tls-*, logs-nginx.access-*, logs-apache.access-*, logs-apache_tomcat.access-*, logs-iis.access-*
from logs-nginx.access-*, logs-apache.access-*, logs-apache_tomcat.access-*, logs-iis.access-*
| where
(url.original is not null or url.full is not null) and
http.request.method == "GET" and
http.response.status_code in (404, 403)
| eval Esql.url_text = case(url.original is not null, url.original, url.full)
| eval Esql.url_lower = to_lower(Esql.url_text)
| eval Esql.url_original_to_lower = to_lower(url.original)
| keep
@timestamp,
@@ -82,19 +78,19 @@ from logs-network_traffic.http-*, logs-network_traffic.tls-*, logs-nginx.access-
source.ip,
agent.id,
host.name,
Esql.url_lower
Esql.url_original_to_lower
| stats
Esql.event_count = count(),
Esql.url_lower_count_distinct = count_distinct(Esql.url_lower),
Esql.url_original_count_distinct = count_distinct(Esql.url_original_to_lower),
Esql.host_name_values = values(host.name),
Esql.agent_id_values = values(agent.id),
Esql.http_request_method_values = values(http.request.method),
Esql.http_response_status_code_values = values(http.response.status_code),
Esql.url_path_values = values(Esql.url_lower),
Esql.url_original_values = values(Esql.url_original_to_lower),
Esql.event_dataset_values = values(event.dataset)
by source.ip
| where
Esql.event_count > 500 and Esql.url_lower_count_distinct > 250
Esql.event_count > 500 and Esql.url_original_count_distinct > 250
'''
[[rule.threat]]
rules/cross-platform/reconnaissance_web_server_unusual_spike_in_error_logs.toml
+2 -2
View File
@@ -2,7 +2,7 @@
creation_date = "2025/11/19"
integration = ["nginx", "apache", "apache_tomcat", "iis"]
maturity = "production"
updated_date = "2025/11/25"
updated_date = "2025/12/01"
[rule]
author = ["Elastic"]
@@ -80,7 +80,7 @@ from logs-nginx.error-*, logs-apache_tomcat.error-*, logs-apache.error-*, logs-i
Esql.event_dataset_values = values(event.dataset)
by source.ip, agent.id
| where
Esql.event_count > 25
Esql.event_count > 50
'''
[[rule.threat]]
rules/cross-platform/reconnaissance_web_server_unusual_spike_in_error_response_codes.toml
+7 -10
View File
@@ -1,8 +1,8 @@
[metadata]
creation_date = "2025/11/19"
integration = ["network_traffic", "nginx", "apache", "apache_tomcat", "iis"]
integration = ["nginx", "apache", "apache_tomcat", "iis"]
maturity = "production"
updated_date = "2025/11/24"
updated_date = "2025/12/01"
[rule]
author = ["Elastic"]
@@ -53,10 +53,8 @@ rule_id = "6fa3abe3-9cd8-41de-951b-51ed8f710523"
severity = "low"
tags = [
"Domain: Web",
"Domain: Network",
"Use Case: Threat Detection",
"Tactic: Reconnaissance",
"Data Source: Network Packet Capture",
"Data Source: Nginx",
"Data Source: Apache",
"Data Source: Apache Tomcat",
@@ -66,9 +64,8 @@ tags = [
timestamp_override = "event.ingested"
type = "esql"
query = '''
from logs-network_traffic.http-*, logs-network_traffic.tls-*, logs-nginx.access-*, logs-apache.access-*, logs-apache_tomcat.access-*, logs-iis.access-*
from logs-nginx.access-*, logs-apache.access-*, logs-apache_tomcat.access-*, logs-iis.access-*
| where
(url.original is not null or url.full is not null) and
http.request.method == "GET" and
http.response.status_code in (
500, // Internal Server Error
@@ -76,8 +73,8 @@ from logs-network_traffic.http-*, logs-network_traffic.tls-*, logs-nginx.access-
503, // Service Unavailable
504 // Gateway Timeout
)
| eval Esql.url_text = case(url.original is not null, url.original, url.full)
| eval Esql.url_lower = to_lower(Esql.url_text)
| eval Esql.url_original_to_lower = to_lower(url.original)
| keep
@timestamp,
@@ -87,7 +84,7 @@ from logs-network_traffic.http-*, logs-network_traffic.tls-*, logs-nginx.access-
source.ip,
agent.id,
host.name,
Esql.url_lower
Esql.url_original_to_lower
| stats
Esql.event_count = count(),
Esql.http_response_status_code_count = count(http.response.status_code),
@@ -96,7 +93,7 @@ from logs-network_traffic.http-*, logs-network_traffic.tls-*, logs-nginx.access-
Esql.agent_id_values = values(agent.id),
Esql.http_request_method_values = values(http.request.method),
Esql.http_response_status_code_values = values(http.response.status_code),
Esql.url_path_values = values(Esql.url_lower),
Esql.url_path_values = values(Esql.url_original_to_lower),
Esql.event_dataset_values = values(event.dataset)
by source.ip, agent.id
| where
rules/cross-platform/reconnaissance_web_server_unusual_user_agents.toml
+33 -41
View File
@@ -1,8 +1,8 @@
[metadata]
creation_date = "2025/11/19"
integration = ["nginx", "apache", "apache_tomcat", "iis", "network_traffic"]
integration = ["nginx", "apache", "apache_tomcat", "iis"]
maturity = "production"
updated_date = "2025/11/24"
updated_date = "2025/12/01"
[rule]
author = ["Elastic"]
@@ -52,11 +52,9 @@ rule_id = "a1b7ffa4-bf80-4bf1-86ad-c3f4dc718b35"
severity = "low"
tags = [
"Domain: Web",
"Domain: Network",
"Use Case: Threat Detection",
"Tactic: Reconnaissance",
"Tactic: Credential Access",
"Data Source: Network Packet Capture",
"Data Source: Nginx",
"Data Source: Apache",
"Data Source: Apache Tomcat",
@@ -66,40 +64,34 @@ tags = [
timestamp_override = "event.ingested"
type = "esql"
query = '''
from logs-network_traffic.http-*, logs-network_traffic.tls-*, logs-nginx.access-*, logs-apache.access-*, logs-apache_tomcat.access-*, logs-iis.access-*
from logs-nginx.access-*, logs-apache.access-*, logs-apache_tomcat.access-*, logs-iis.access-*
| eval Esql.user_agent_original_lower = to_lower(user_agent.original)
| eval Esql.user_agent_original_to_lower = to_lower(user_agent.original), Esql.url_original_to_lower = to_lower(url.original)
| where
(url.original is not null or url.full is not null) and
(
Esql.user_agent_original_lower like "mozilla/5.0 (windows nt 10.0; win64; x64) applewebkit/537.36 (khtml, like gecko) chrome/74.0.3729.169 safari/537.36" or // Nikto
Esql.user_agent_original_lower like "nikto*" or // Nikto
Esql.user_agent_original_lower like "mozilla/4.0 (compatible; msie 8.0; windows nt 5.1; trident/4.0)" or // Nessus Vulnerability Scanner
Esql.user_agent_original_lower like "*nessus*" or // Nessus Vulnerability Scanner
Esql.user_agent_original_lower like "sqlmap/*" or // SQLMap
Esql.user_agent_original_lower like "wpscan*" or // WPScan
Esql.user_agent_original_lower like "feroxbuster/*" or // Feroxbuster
Esql.user_agent_original_lower like "masscan*" or // Masscan & masscan-ng
Esql.user_agent_original_lower like "fuzz*" or // Ffuf
Esql.user_agent_original_lower like "mozilla/5.0 (windows nt 10.0; win64; x64) applewebkit/537.36 (khtml, like gecko) chrome/user_agent.original like~ 87.0.4280.88 safari/537.36" or // Dirsearch
Esql.user_agent_original_lower like "mozilla/4.0 (compatible; msie 6.0; windows nt 5.1)" or // Dirb
Esql.user_agent_original_lower like "dirbuster*" or // Dirbuster
Esql.user_agent_original_lower like "gobuster/*" or // Gobuster
Esql.user_agent_original_lower like "*dirsearch*" or // dirsearch
Esql.user_agent_original_lower like "*nmap*" or // Nmap Scripting Engine
Esql.user_agent_original_lower like "*hydra*" or // Hydra Brute Forcer
Esql.user_agent_original_lower like "*w3af*" or // w3af Web Application Attack and Audit Framework
Esql.user_agent_original_lower like "*arachni*" or // Arachni Web Application Security Scanner
Esql.user_agent_original_lower like "*skipfish*" or // Skipfish Web Application Security Scanner
Esql.user_agent_original_lower like "*openvas*" or // OpenVAS Vulnerability Scanner
Esql.user_agent_original_lower like "*acunetix*" or // Acunetix Vulnerability Scanner
Esql.user_agent_original_lower like "*zap*" or // OWASP ZAP
Esql.user_agent_original_lower like "*burp*" // Burp Suite
)
| eval Esql.url_text = case(url.original is not null, url.original, url.full)
| eval Esql.url_lower = to_lower(Esql.url_text)
Esql.user_agent_original_to_lower like "mozilla/5.0 (windows nt 10.0; win64; x64) applewebkit/537.36 (khtml, like gecko) chrome/74.0.3729.169 safari/537.36" or // Nikto
Esql.user_agent_original_to_lower like "nikto*" or // Nikto
Esql.user_agent_original_to_lower like "mozilla/4.0 (compatible; msie 8.0; windows nt 5.1; trident/4.0)" or // Nessus Vulnerability Scanner
Esql.user_agent_original_to_lower like "*nessus*" or // Nessus Vulnerability Scanner
Esql.user_agent_original_to_lower like "sqlmap/*" or // SQLMap
Esql.user_agent_original_to_lower like "wpscan*" or // WPScan
Esql.user_agent_original_to_lower like "feroxbuster/*" or // Feroxbuster
Esql.user_agent_original_to_lower like "masscan*" or // Masscan & masscan-ng
Esql.user_agent_original_to_lower like "fuzz*" or // Ffuf
Esql.user_agent_original_to_lower like "mozilla/5.0 (windows nt 10.0; win64; x64) applewebkit/537.36 (khtml, like gecko) chrome/user_agent.original like~ 87.0.4280.88 safari/537.36" or // Dirsearch
Esql.user_agent_original_to_lower like "mozilla/4.0 (compatible; msie 6.0; windows nt 5.1)" or // Dirb
Esql.user_agent_original_to_lower like "dirbuster*" or // Dirbuster
Esql.user_agent_original_to_lower like "gobuster/*" or // Gobuster
Esql.user_agent_original_to_lower like "*dirsearch*" or // dirsearch
Esql.user_agent_original_to_lower like "*nmap*" or // Nmap Scripting Engine
Esql.user_agent_original_to_lower like "*hydra*" or // Hydra Brute Forcer
Esql.user_agent_original_to_lower like "*w3af*" or // w3af Web Application Attack and Audit Framework
Esql.user_agent_original_to_lower like "*arachni*" or // Arachni Web Application Security Scanner
Esql.user_agent_original_to_lower like "*skipfish*" or // Skipfish Web Application Security Scanner
Esql.user_agent_original_to_lower like "*openvas*" or // OpenVAS Vulnerability Scanner
Esql.user_agent_original_to_lower like "*acunetix*" or // Acunetix Vulnerability Scanner
Esql.user_agent_original_to_lower like "*zap*" or // OWASP ZAP
Esql.user_agent_original_to_lower like "*burp*" // Burp Suite
| keep
@timestamp,
@@ -108,19 +100,19 @@ from logs-network_traffic.http-*, logs-network_traffic.tls-*, logs-nginx.access-
source.ip,
agent.id,
host.name,
Esql.url_lower,
Esql.user_agent_original_lower
Esql.url_original_to_lower,
Esql.user_agent_original_to_lower
| stats
Esql.event_count = count(),
Esql.url_path_count_distinct = count_distinct(Esql.url_lower),
Esql.url_original_count_distinct = count_distinct(Esql.url_original_to_lower),
Esql.host_name_values = values(host.name),
Esql.agent_id_values = values(agent.id),
Esql.url_path_values = values(Esql.url_lower),
Esql.user_agent_original_values = values(Esql.user_agent_original_lower),
Esql.url_original_values = values(Esql.url_original_to_lower),
Esql.user_agent_original_values = values(Esql.user_agent_original_to_lower),
Esql.event_dataset_values = values(event.dataset)
by source.ip, agent.id
| where
Esql.event_count > 50 and Esql.url_path_count_distinct > 10
Esql.event_count > 50 and Esql.url_original_count_distinct > 10
'''
[[rule.threat]]