Query: alert when Detects XSS attempts injected via GET requests in access logs
Matching passage: Sigma rule: Detects XSS attempts injected via GET requests in access logs. Logsource: webserver. Rule: title: Cross Site Scripting Strings id: 65354b83-a2ea-4ea6-8414-3ab38be0d409 status: test description: Detects XSS attempts injected via GET requests in access logs references: - https://github.com/payloadbox/xss-payload-list - https://portswigger.net/web-security/cross-site-scripting/contexts author: Saw Win Naung, Nasreddine Bencherchali date: 2021-08-15 modified: 2022-06-14 tags: - attack.initial-access - attack.t1189 logsource: category: webserver detection: select_method: cs-method: GET keywords: - =<script> - =%3Cscript%3E - =%253Cscript%253E - '<iframe ' - '%3Ciframe ' - '<svg ' - '%3Csvg ' - document.cookie - document.domain - ' onerror=' - ' onresize=' - ' onload="' - onmouseover= - ${alert - javascript:alert - javascript%3Aalert filter: sc-status: 404 condition: select_method and keywords and not filter falsepositives: - JavaScripts,CSS Files and PNG files - User searches in search boxes of the respective website - Internal vulnerability scanners can cause some serious FPs when used, if you experience a lot of FPs due to this think of adding more filters such as "User Agent" strings and more response codes level: high
Near-miss passage: Sigma rule: Detects base64 encoded strings used in hidden malicious PowerShell command lines. Logsource: windows / process_creation. Rule: title: Malicious Base64 Encoded PowerShell Keywords in Command Lines id: f26c6093-6f14-4b12-800f-0fcb46f5ffd0 status: test description: Detects base64 encoded strings used in hidden malicious PowerShell command lines references: - http://www.leeholmes.com/blog/2017/09/21/searching-for-content-in-base-64-strings/ author: John Lambert (rule) date: 2019-01-16 modified: 2023-01-05 tags: - attack.execution - attack.t1059.001 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: - \powershell.exe - \pwsh.exe - OriginalFileName: - PowerShell.EXE - pwsh.dll selection_hidden: CommandLine|contains: ' hidden ' selection_encoded: CommandLine|contains: - AGkAdABzAGEAZABtAGkAbgAgAC8AdAByAGEAbgBzAGYAZQByA - aXRzYWRtaW4gL3RyYW5zZmVy - IAaQB0AHMAYQBkAG0AaQBuACAALwB0AHIAYQBuAHMAZgBlAHIA - JpdHNhZG1pbiAvdHJhbnNmZX - YgBpAHQAcwBhAGQAbQBpAG4AIAAvAHQAcgBhAG4AcwBmAGUAcg - Yml0c2FkbWluIC90cmFuc2Zlc - AGMAaAB1AG4AawBfAHMAaQB6AGUA - JABjAGgAdQBuAGsAXwBzAGkAegBlA - JGNodW5rX3Npem - QAYwBoAHUAbgBrAF8AcwBpAHoAZQ - RjaHVua19zaXpl - Y2h1bmtfc2l6Z - AE8ALgBDAG8AbQBwAHIAZQBzAHMAaQBvAG4A - kATwAuAEMAbwBtAHAAcgBlAHMAcwBpAG8Abg - lPLkNvbXByZXNzaW9u - SQBPAC4AQwBvAG0AcAByAGUAcwBzAGkAbwBuA - SU8uQ29tcHJlc3Npb2 - Ty5Db21wcmVzc2lvb - AE8ALgBNAGUAbQBvAHIAeQBTAHQAcgBlAGEAbQ - kATwAuAE0AZQBtAG8AcgB5AFMAdAByAGUAYQBtA - lPLk1lbW9yeVN0cmVhb - SQBPAC4ATQBlAG0AbwByAHkAUwB0AHIAZQBhAG0A - SU8uTWVtb3J5U3RyZWFt - Ty5NZW1vcnlTdHJlYW - 4ARwBlAHQAQwBoAHUAbgBrA - 5HZXRDaHVua - AEcAZQB0AEMAaAB1AG4Aaw - LgBHAGUAdABDAGgAdQBuAGsA - LkdldENodW5r - R2V0Q2h1bm - AEgAUgBFAEEARABfAEkATgBGAE8ANgA0A - QASABSAEUAQQBEAF8ASQBOAEYATwA2ADQA - RIUkVBRF9JTkZPNj - SFJFQURfSU5GTzY0 - VABIAFIARQBBAEQAXwBJAE4ARgBPADYANA - VEhSRUFEX0lORk82N - AHIAZQBhAHQAZQBSAGUAbQBvAHQAZQBUAGgAcgBlAGEAZA - cmVhdGVSZW1vdGVUaHJlYW - MAcgBlAGEAdABlAFIAZQBtAG8AdABlAFQAaAByAGUAYQBkA - NyZWF0ZVJlbW90ZVRocmVhZ - Q3JlYXRlUmVtb3RlVGhyZWFk - QwByAGUAYQB0AGUAUgBlAG0AbwB0AGUAVABoAHIAZQBhAGQA - 0AZQBtAG0AbwB2AGUA - 1lbW1vdm - AGUAbQBtAG8AdgBlA - bQBlAG0AbQBvAHYAZQ - bWVtbW92Z - ZW1tb3Zl condition: all of selection_* falsepositives: - Unknown level: high