Detectionmediumtest

Successful IIS Shortname Fuzzing Scan

When IIS uses an old .Net Framework it's possible to enumerate folders with the symbol "~"

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch

François HubautCreated Wed Oct 06Updated Mon Jan 027cb02516-6d95-4ffc-8eee-162075e111acweb

Log Source

Web Server Log

CategoryWeb Server Log← raw: webserver

HTTP access logs from web servers capturing request paths, methods, and status codes.

Detection Logic

detection:
    selection:
        cs-uri-query|contains: '~1'
        cs-uri-query|endswith: 'a.aspx'
        cs-method:
            - GET
            - OPTIONS
        # Success only
        sc-status:
            - 200
            - 301
    condition: selection