Phoenix
Sigma IntelligenceBeta
Back to Rules
Detectionmediumstable

Django Framework Exceptions

Detects suspicious Django web application framework exceptions that could indicate exploitation attempts

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch
Thomas PatzkeCreated Sat Aug 05Updated Tue Sep 01fd435618-981e-4a7c-81f8-f78ce480d616application
Log Source
djangoapplication
Productdjango← raw: django
Categoryapplication← raw: application
Detection Logic
Detection Logic1 selector
detection:
    keywords:
        - SuspiciousOperation
        # Subclasses of SuspiciousOperation
        - DisallowedHost
        - DisallowedModelAdminLookup
        - DisallowedModelAdminToField
        - DisallowedRedirect
        - InvalidSessionKey
        - RequestDataTooBig
        - SuspiciousFileOperation
        - SuspiciousMultipartForm
        - SuspiciousSession
        - TooManyFieldsSent
        # Further security-related exceptions
        - PermissionDenied
    condition: keywords
False Positives

Application bugs

References
1
Resolving title…
docs.djangoproject.com
2
Resolving title…
docs.djangoproject.com
MITRE ATT&CK
Rule Metadata
Rule ID
fd435618-981e-4a7c-81f8-f78ce480d616
Status
stable
Level
medium
Type
Detection
Created
Sat Aug 05
Modified
Tue Sep 01
Author
Thomas Patzke
Path
rules/application/django/appframework_django_exceptions.yml
Raw Tags
attack.initial-accessattack.t1190
View on GitHub