Skip to content

Commit b0cc0cb

Browse files
Aegrahterrancedejesus
Aegrah
and
terrancedejesus
authored
[New Rule] Web Server Suspicious User Agent Request Spike (#5340)
* [New Rule] Web Server Unusual User Agent Request * [New Rule] Web Server Suspicious User Agent Request Spike * Update reconnaissance_web_server_unusual_user_agents.toml * Update reconnaissance_web_server_unusual_user_agents.toml * ++ * ++ * Rename rule for suspicious user agent requests * fixing from indices formatting --------- Co-authored-by: Terrance DeJesus <[email protected]> Co-authored-by: terrancedejesus <[email protected]>
1 parent 4f8c967 commit b0cc0cb

File tree

1 file changed

+133
-0
lines changed

1 file changed

+133
-0
lines changed

‎rules/cross-platform/reconnaissance_web_server_unusual_user_agents.toml‎

Lines changed: 133 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,133 @@
1+
[metadata]
2+
creation_date = "2025/11/19"
3+
integration = ["nginx", "apache", "apache_tomcat", "iis", "network_traffic"]
4+
maturity = "production"
5+
updated_date = "2025/11/19"
6+
7+
[rule]
8+
author = ["Elastic"]
9+
description = """
10+
This rule detects unusual spikes in web server requests with uncommon or suspicious user-agent strings. Such activity may
11+
indicate reconnaissance attempts by attackers trying to identify vulnerabilities in web applications or servers. These
12+
user-agents are often associated with automated tools used for scanning, vulnerability assessment, or brute-force attacks.
13+
"""
14+
from = "now-9m"
15+
interval = "10m"
16+
language = "esql"
17+
license = "Elastic License v2"
18+
name = "Web Server Suspicious User Agent Requests"
19+
risk_score = 21
20+
rule_id = "a1b7ffa4-bf80-4bf1-86ad-c3f4dc718b35"
21+
severity = "low"
22+
tags = [
23+
"Domain: Web",
24+
"Domain: Network",
25+
"Use Case: Threat Detection",
26+
"Tactic: Reconnaissance",
27+
"Tactic: Credential Access",
28+
"Data Source: Network Packet Capture",
29+
"Data Source: Nginx",
30+
"Data Source: Apache",
31+
"Data Source: Apache Tomcat",
32+
"Data Source: IIS",
33+
]
34+
timestamp_override = "event.ingested"
35+
type = "esql"
36+
query = '''
37+
from logs-network_traffic.http-*, logs-network_traffic.tls-*, logs-nginx.access-*, logs-apache.access-*, logs-apache_tomcat.access-*, logs-iis.access-*
38+
39+
| eval Esql.user_agent_original_lower = to_lower(user_agent.original)
40+
41+
| where
42+
(url.original is not null or url.full is not null) and
43+
(
44+
Esql.user_agent_original_lower like "mozilla/5.0 (windows nt 10.0; win64; x64) applewebkit/537.36 (khtml, like gecko) chrome/74.0.3729.169 safari/537.36" or // Nikto
45+
Esql.user_agent_original_lower like "nikto*" or // Nikto
46+
Esql.user_agent_original_lower like "mozilla/4.0 (compatible; msie 8.0; windows nt 5.1; trident/4.0)" or // Nessus Vulnerability Scanner
47+
Esql.user_agent_original_lower like "*nessus*" or // Nessus Vulnerability Scanner
48+
Esql.user_agent_original_lower like "sqlmap/*" or // SQLMap
49+
Esql.user_agent_original_lower like "wpscan*" or // WPScan
50+
Esql.user_agent_original_lower like "feroxbuster/*" or // Feroxbuster
51+
Esql.user_agent_original_lower like "masscan*" or // Masscan & masscan-ng
52+
Esql.user_agent_original_lower like "fuzz*" or // Ffuf
53+
Esql.user_agent_original_lower like "mozilla/5.0 (windows nt 10.0; win64; x64) applewebkit/537.36 (khtml, like gecko) chrome/user_agent.original like~ 87.0.4280.88 safari/537.36" or // Dirsearch
54+
Esql.user_agent_original_lower like "mozilla/4.0 (compatible; msie 6.0; windows nt 5.1)" or // Dirb
55+
Esql.user_agent_original_lower like "dirbuster*" or // Dirbuster
56+
Esql.user_agent_original_lower like "gobuster/*" or // Gobuster
57+
Esql.user_agent_original_lower like "*dirsearch*" or // dirsearch
58+
Esql.user_agent_original_lower like "*nmap*" or // Nmap Scripting Engine
59+
Esql.user_agent_original_lower like "*hydra*" or // Hydra Brute Forcer
60+
Esql.user_agent_original_lower like "*w3af*" or // w3af Web Application Attack and Audit Framework
61+
Esql.user_agent_original_lower like "*arachni*" or // Arachni Web Application Security Scanner
62+
Esql.user_agent_original_lower like "*skipfish*" or // Skipfish Web Application Security Scanner
63+
Esql.user_agent_original_lower like "*openvas*" or // OpenVAS Vulnerability Scanner
64+
Esql.user_agent_original_lower like "*acunetix*" or // Acunetix Vulnerability Scanner
65+
Esql.user_agent_original_lower like "*zap*" or // OWASP ZAP
66+
Esql.user_agent_original_lower like "*burp*" // Burp Suite
67+
)
68+
69+
| eval Esql.url_text = case(url.original is not null, url.original, url.full)
70+
| eval Esql.url_lower = to_lower(Esql.url_text)
71+
72+
| keep
73+
@timestamp,
74+
event.dataset,
75+
user_agent.original,
76+
source.ip,
77+
agent.id,
78+
host.name,
79+
Esql.url_lower,
80+
Esql.user_agent_original_lower
81+
| stats
82+
Esql.event_count = count(),
83+
Esql.url_path_count_distinct = count_distinct(Esql.url_lower),
84+
Esql.host_name_values = values(host.name),
85+
Esql.agent_id_values = values(agent.id),
86+
Esql.url_path_values = values(Esql.url_lower),
87+
Esql.user_agent_original_values = values(Esql.user_agent_original_lower),
88+
Esql.event_dataset_values = values(event.dataset)
89+
by source.ip, agent.id
90+
| where
91+
Esql.event_count > 50 and Esql.url_path_count_distinct > 10
92+
'''
93+
94+
[[rule.threat]]
95+
framework = "MITRE ATT&CK"
96+
97+
[[rule.threat.technique]]
98+
id = "T1595"
99+
name = "Active Scanning"
100+
reference = "https://attack.mitre.org/techniques/T1595/"
101+
102+
[[rule.threat.technique.subtechnique]]
103+
id = "T1595.001"
104+
name = "Scanning IP Blocks"
105+
reference = "https://attack.mitre.org/techniques/T1595/001/"
106+
107+
[[rule.threat.technique.subtechnique]]
108+
id = "T1595.002"
109+
name = "Vulnerability Scanning"
110+
reference = "https://attack.mitre.org/techniques/T1595/002/"
111+
112+
[[rule.threat.technique.subtechnique]]
113+
id = "T1595.003"
114+
name = "Wordlist Scanning"
115+
reference = "https://attack.mitre.org/techniques/T1595/003/"
116+
117+
[rule.threat.tactic]
118+
id = "TA0043"
119+
name = "Reconnaissance"
120+
reference = "https://attack.mitre.org/tactics/TA0043/"
121+
122+
[[rule.threat]]
123+
framework = "MITRE ATT&CK"
124+
125+
[[rule.threat.technique]]
126+
id = "T1110"
127+
name = "Brute Force"
128+
reference = "https://attack.mitre.org/techniques/T1110/"
129+
130+
[rule.threat.tactic]
131+
id = "TA0006"
132+
name = "Credential Access"
133+
reference = "https://attack.mitre.org/tactics/TA0006/"

0 commit comments

Comments
 (0)