Elastic low stable kql

Web Server Potential Spike in Error Response Codes

This rule detects unusual spikes in error response codes (500, 502, 503, 504) from web servers, which may indicate reconnaissance activities such as vulnerability scanning or fuzzing attempts by adversaries. These activities often generate a high volume of error responses as they probe for weaknesses in web applications. Error response codes may potentially indicate server-side issues that could be exploited.

View Source

Detection Logic

from logs-nginx.access-*, logs-apache.access-*, logs-apache_tomcat.access-*, logs-iis.access-*, logs-traefik.access-*
| where
    http.request.method == "GET" and
    http.response.status_code in (
      500, // Internal Server Error
      502, // Bad Gateway
      503, // Service Unavailable
      504 // Gateway Timeout
    )
| eval Esql.url_original_to_lower = to_lower(url.original)
| keep
    @timestamp,
    data_stream.dataset,
    http.request.method,
    http.response.status_code,
    source.ip,
    agent.id,
    agent.name,
    Esql.url_original_to_lower,
    data_stream.namespace
| stats
    Esql.event_count = count(),
    Esql.http_response_status_code_count = count(http.response.status_code),
    Esql.http_response_status_code_values = values(http.response.status_code),
    Esql.agent_name_values = values(agent.name),
    Esql.agent_id_values = values(agent.id),
    Esql.http_request_method_values = values(http.request.method),
    Esql.http_response_status_code_values = values(http.response.status_code),
    Esql.url_path_values = values(Esql.url_original_to_lower),
    Esql.data_stream_dataset_values = values(data_stream.dataset),
    Esql.data_stream_namespace_values = values(data_stream.namespace)
    by source.ip, agent.id
| where
    Esql.http_response_status_code_count > 10

Field Validations

Loading…

Comments (0)

Loading comments...