author: Bhavin Patel, Splunk
date: '2017-10-20'
description: This search helps an analyst investigate a notable event related to a
  potential Apache Struts exploitation. To investigate, we will want to isolate and
  analyze the "payload" or the commands that were passed to the vulnerable hosts by
  creating a few regular expressions to carve out the commands focusing on common
  keywords from the payload, such as cmd.exe, /bin/bash and whois. The search returns
  these suspicious strings found in the HTTP logs of the system of interest.
how_to_implement: This particular search leverages data extracted from Stream:HTTP.
  You must configure the http stream using the Splunk Stream App on your Splunk Stream
  deployment server to extract the cs_content_type field.
id: bc91a8cf-35e7-4bb2-8140-e756cc06fd89
inputs:
- src_ip
- dest_ip
name: Investigate Suspicious Strings in HTTP Header
search: '| search sourcetype=stream:http | search src_ip=$src_ip$ | search dest_ip=$dest_ip$
  | eval cs_content_type_length = len(cs_content_type) | search cs_content_type_length
  > 100 | rex field="cs_content_type" (?<suspicious_strings>cmd.exe) | eval suspicious_strings_found=if(match(cs_content_type,
  "application"), "True", "False")  | rename suspicious_strings_found AS "Suspicious
  Content-Type Found" | fields "Suspicious Content-Type Found", dest_ip, src_ip, suspicious_strings,
  cs_content_type, cs_content_type_length, url'
tags:
  analytic_story:
  - Apache Struts Vulnerability
  product:
  - Splunk Phantom
type: response
version: 1
