Detectionhightest

Cross Site Scripting Strings

Detects XSS attempts injected via GET requests in access logs

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Saw Win Naung, Nasreddine Bencherchali (Nextron Systems)Created Sun Aug 15Updated Tue Jun 1465354b83-a2ea-4ea6-8414-3ab38be0d409web

Log Source

Web Server Log

CategoryWeb Server Log← raw: webserver

HTTP access logs from web servers capturing request paths, methods, and status codes.

Detection Logic

detection:
    select_method:
        cs-method: 'GET'
    keywords:
        - '=<script>'
        - '=%3Cscript%3E'
        - '=%253Cscript%253E'
        - '<iframe '
        - '%3Ciframe '
        - '<svg '
        - '%3Csvg '
        - 'document.cookie'
        - 'document.domain'
        - ' onerror='
        - ' onresize='
        - ' onload="'
        - 'onmouseover='
        - '${alert'
        - 'javascript:alert'
        - 'javascript%3Aalert'
    filter:
        sc-status: 404
    condition: select_method and keywords and not filter

False Positives

JavaScripts,CSS Files and PNG files

User searches in search boxes of the respective website

Internal vulnerability scanners can cause some serious FPs when used, if you experience a lot of FPs due to this think of adding more filters such as "User Agent" strings and more response codes

References

MITRE ATT&CK

Tactics

TA0001 · Initial Access

Techniques

T1189 · Drive-by Compromise

Rule Metadata

Rule ID