huntrule

Django Application Error Exceptions Matching SuspiciousOperation and Security Exceptions

Identifies Django logs containing suspicious security-related exception names that may indicate exploitation attempts.

FreeReviewedSigma · Medium · v5
Product
django
Category
application
Author
Thomas Patzke (SigmaHQ), DRL 1.1
Published
2017-08-05
Updated
2026-07-31
AnalysisDetection

ATT&CK techniques

Initial Access

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule flags application log events from Django that contain exception names related to SuspiciousOperation and specific security-focused subclasses such as DisallowedHost, DisallowedRedirect, InvalidSessionKey, PermissionDenied, and RequestDataTooBig. These exceptions can occur when an attacker sends unexpected or malicious requests designed to trigger validation, authorization, or request-handling failures. The detection relies on application telemetry where Django exceptions are recorded as keyworded exception identifiers in log messages.

Reporting behind it

Related detections9 linkedT1190 — drag to rearrange
Suspicious Telerik UI RadAsyncUpload Request Indicating CVE-2019-18935 Exploitation (via webserver)
Malicious IIS Worker Process Spawning Shell for Out-of-Band Interaction via Command Line
Malicious wp2shell WordPress Exploitation via Batch Endpoint User Agent
Suspicious TOLLBOOTH Webshell URI Access
Suspicious ffuf Fuzzing Requests Against Web Server
Suspicious AI Agent Compromise via Web Worker Spawning Shell or Network Tool
Malicious wp2shell WordPress RCE via Web Server Spawning Shell Recon
Suspicious Child Process Spawned by IIS Worker Process w3wp
Possible Log4Shell Exploitation via Java Spawning Shell or Download Utility
Django Application Error Exceptions Matching SuspiciousOperation and Security Exceptions
Pivot detection · T1190 · 9 related

Changelog

v5
  1. v5
    Candidate ingested via manual entry.2026-07-31
  2. v4
    Candidate ingested via manual entry.2026-07-31
  3. v3
    Candidate ingested via manual entry.2026-07-31
  4. v2
    Candidate ingested via manual entry.2026-07-31
  5. v1
    No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.