Detectionmediumstable

Ruby on Rails Framework Exceptions

Detects suspicious Ruby on Rails exceptions that could indicate exploitation attempts

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch
Thomas PatzkeCreated Sun Aug 06Updated Tue Sep 010d2c3d4c-4b48-4ac3-8f23-ea845746bb1aapplication
Log Source
ruby_on_railsapplication
Productruby_on_rails← raw: ruby_on_rails
Categoryapplication← raw: application
Detection Logic
Detection Logic1 selector
detection:
    keywords:
        - ActionController::InvalidAuthenticityToken
        - ActionController::InvalidCrossOriginRequest
        - ActionController::MethodNotAllowed
        - ActionController::BadRequest
        - ActionController::ParameterMissing
    condition: keywords
False Positives

Application bugs

Rule Metadata
Rule ID
0d2c3d4c-4b48-4ac3-8f23-ea845746bb1a
Status
stable
Level
medium
Type
Detection
Created
Sun Aug 06
Modified
Tue Sep 01
Path
rules/application/ruby/appframework_ruby_on_rails_exceptions.yml
Raw Tags
attack.initial-accessattack.t1190
View on GitHub