name: Unusually Long Content-Type Length
id: 57a0a2bf-353f-40c1-84dc-29293f3c35b7
version: 1
date: '2017-10-13'
author: Bhavin Patel, Splunk
type: batch
datamodel: []
description: This search looks for unusually long strings in the Content-Type http
  header that the client sends the server.
search: '`stream_http` | eval cs_content_type_length = len(cs_content_type) | where
  cs_content_type_length > 100 | table endtime src_ip dest_ip cs_content_type_length
  cs_content_type url | `unusually_long_content_type_length_filter`'
how_to_implement: This particular search leverages data extracted from Stream:HTTP.
  You must configure the http stream using the Splunk Stream App on your Splunk Stream
  deployment server to extract the cs_content_type field.
known_false_positives: Very few legitimate Content-Type fields will have a length
  greater than 100 characters.
references: []
tags:
  analytic_story:
  - Apache Struts Vulnerability
  asset_type: Web Server
  cis20:
  - CIS 3
  - CIS 4
  - CIS 18
  - CIS 12
  kill_chain_phases:
  - Delivery
  nist:
  - ID.RA
  - RS.MI
  - PR.PT
  - PR.IP
  - DE.AE
  - PR.MA
  - DE.CM
  product:
  - Splunk Enterprise
  - Splunk Enterprise Security
  - Splunk Cloud
  required_fields:
  - _time
  - cs_content_type
  - endtime
  - src_ip
  - dest_ip
  - url
  security_domain: network
