Django Application Exceptions: Suspicious Security-Related Errors

Identifies Django logs containing suspicious security-related exception names that may indicate exploitation attempts.

FreeUnreviewedSigmamediumv1

django-application-exceptions-suspicious-security-related-errors-fd435618

title: "Django Application Exceptions: Suspicious Security-Related Errors"
id: d4e72cea-ee5c-466c-bac8-cdad39947b2a
status: stable
description: This rule flags Django application log events containing keywords for security-related and suspicious operation exceptions, such as SuspiciousOperation and its disallowed/invalid variants. These exceptions can reflect probing or exploitation attempts against routing, redirects, session handling, request limits, or file/form operations. It relies on application log text matching the listed exception names captured by Django. Output triage should account for application bugs that may also trigger these exceptions.
references:
  - https://docs.djangoproject.com/en/1.11/ref/exceptions/
  - https://docs.djangoproject.com/en/1.11/topics/logging/#django-security
  - https://github.com/SigmaHQ/sigma/blob/master/rules/application/django/appframework_django_exceptions.yml
author: Thomas Patzke, Huntrule Team
date: 2017-08-05
modified: 2020-09-01
tags:
  - attack.initial-access
  - attack.t1190
logsource:
  category: application
  product: django
detection:
  keywords:
    - SuspiciousOperation
    - DisallowedHost
    - DisallowedModelAdminLookup
    - DisallowedModelAdminToField
    - DisallowedRedirect
    - InvalidSessionKey
    - RequestDataTooBig
    - SuspiciousFileOperation
    - SuspiciousMultipartForm
    - SuspiciousSession
    - TooManyFieldsSent
    - PermissionDenied
  condition: keywords
falsepositives:
  - Application bugs
level: medium
license: DRL-1.1
related:
  - id: fd435618-981e-4a7c-81f8-f78ce480d616
    type: derived

What it detects

This rule flags Django application log events containing keywords for security-related and suspicious operation exceptions, such as SuspiciousOperation and its disallowed/invalid variants. These exceptions can reflect probing or exploitation attempts against routing, redirects, session handling, request limits, or file/form operations. It relies on application log text matching the listed exception names captured by Django. Output triage should account for application bugs that may also trigger these exceptions.

Known false positives

Application bugs

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.