Elastic low stable kql

Web Server Discovery or Fuzzing Activity

This rule detects potential web server discovery or fuzzing activity by identifying a high volume of HTTP GET requests resulting in 404 or 403 status codes from a single source IP address within a short timeframe. Such patterns may indicate that an attacker is attempting to discover hidden or unlinked resources on a web server, which can be a precursor to more targeted attacks.

View Source

Detection Logic

from logs-nginx.access-*, logs-apache.access-*, logs-apache_tomcat.access-*, logs-iis.access-*, logs-traefik.access-*
| where
    http.request.method == "GET" and 
    http.response.status_code in (404, 403)
| eval Esql.url_original_to_lower = to_lower(url.original)
| keep
    @timestamp,
    data_stream.dataset,
    http.request.method,
    http.response.status_code,
    source.ip,
    agent.id,
    agent.name,
    Esql.url_original_to_lower,
    data_stream.namespace
| stats
    Esql.event_count = count(),
    Esql.url_original_count_distinct = count_distinct(Esql.url_original_to_lower),
    Esql.agent_name_values = values(agent.name),
    Esql.agent_id_values = values(agent.id),
    Esql.http_request_method_values = values(http.request.method),
    Esql.http_response_status_code_values = values(http.response.status_code),
    Esql.url_original_values = values(Esql.url_original_to_lower),
    Esql.data_stream_dataset_values = values(data_stream.dataset),
    Esql.data_stream_namespace_values = values(data_stream.namespace)
    by source.ip
| where
  Esql.event_count > 500 and Esql.url_original_count_distinct > 250

Field Validations

Loading…

Comments (0)

Loading comments...