Query: Sigma rule for Detects XSS attempts injected via GET requests in access logs
Matching passage: Sigma rule: Detects XSS attempts injected via GET requests in access logs. Logsource: webserver. Rule: title: Cross Site Scripting Strings id: 65354b83-a2ea-4ea6-8414-3ab38be0d409 status: test description: Detects XSS attempts injected via GET requests in access logs references: - https://github.com/payloadbox/xss-payload-list - https://portswigger.net/web-security/cross-site-scripting/contexts author: Saw Win Naung, Nasreddine Bencherchali date: 2021-08-15 modified: 2022-06-14 tags: - attack.initial-access - attack.t1189 logsource: category: webserver detection: select_method: cs-method: GET keywords: - =<script> - =%3Cscript%3E - =%253Cscript%253E - '<iframe ' - '%3Ciframe ' - '<svg ' - '%3Csvg ' - document.cookie - document.domain - ' onerror=' - ' onresize=' - ' onload="' - onmouseover= - ${alert - javascript:alert - javascript%3Aalert filter: sc-status: 404 condition: select_method and keywords and not filter falsepositives: - JavaScripts,CSS Files and PNG files - User searches in search boxes of the respective website - Internal vulnerability scanners can cause some serious FPs when used, if you experience a lot of FPs due to this think of adding more filters such as "User Agent" strings and more response codes level: high
Near-miss passage: Sigma rule: Detects the creation of a file with an uncommon extension in an Office application startup folder. Logsource: windows / file_event. Rule: title: Uncommon File Created In Office Startup Folder id: a10a2c40-2c4d-49f8-b557-1a946bc55d9d status: test description: Detects the creation of a file with an uncommon extension in an Office application startup folder references: - https://app.any.run/tasks/d6fe6624-6ef8-485d-aa75-3d1bdda2a08c/ - http://addbalance.com/word/startup.htm - https://answers.microsoft.com/en-us/msoffice/forum/all/document-in-word-startup-folder-doesnt-open-when/44ab0932-2917-4150-8cdc-2f2cf39e86f3 - https://en.wikipedia.org/wiki/List_of_Microsoft_Office_filename_extensions author: frack113, Nasreddine Bencherchali (Nextron Systems) date: 2022-06-05 modified: 2023-12-13 tags: - attack.resource-development - attack.t1587.001 logsource: product: windows category: file_event detection: selection_word_paths: - TargetFilename|contains: \Microsoft\Word\STARTUP - TargetFilename|contains|all: - \Office - \Program Files - \STARTUP filter_exclude_word_ext: TargetFilename|endswith: - .docb - .docm - .docx - .dotm - .mdb - .mdw - .pdf - .wll - .wwl selection_excel_paths: - TargetFilename|contains: \Microsoft\Excel\XLSTART - TargetFilename|contains|all: - \Office - \Program Files - \XLSTART filter_exclude_excel_ext: TargetFilename|endswith: - .xll - .xls - .xlsm - .xlsx - .xlt - .xltm - .xlw filter_main_office_click_to_run: Image|contains: :\Program Files\Common Files\Microsoft Shared\ClickToRun\ Image|endswith: \OfficeClickToRun.exe filter_main_office_apps: Image|contains: - :\Program Files\Microsoft Office\ - :\Program Files (x86)\Microsoft Office\ Image|endswith: - \winword.exe - \excel.exe condition: ((selection_word_paths and not filter_exclude_word_ext) or (selection_excel_paths and not filter_exclude_excel_ext)) and not 1 of filter_main_* falsepositives: - False positive might stem from rare extensions used by other Office utilities. level: high