Django Application Error Exceptions Matching SuspiciousOperation and Security Exceptions

Identifies Django logs containing suspicious security-related exception names that may indicate exploitation attempts.

FreeReviewedSigma · Medium · v5

Product: django
Category: application
Author: Thomas Patzke (SigmaHQ), DRL 1.1
Published: 2017-08-05
Updated: 2026-07-31

ATT&CK techniques

Initial Access

Recon
Resource Dev
Initial Access
- T1190Exploit Public-Facing Application
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags application log events from Django that contain exception names related to SuspiciousOperation and specific security-focused subclasses such as DisallowedHost, DisallowedRedirect, InvalidSessionKey, PermissionDenied, and RequestDataTooBig. These exceptions can occur when an attacker sends unexpected or malicious requests designed to trigger validation, authorization, or request-handling failures. The detection relies on application telemetry where Django exceptions are recorded as keyworded exception identifiers in log messages.

Reporting behind it

Related detections9 linkedT1190 — drag to rearrange

Suspicious Executable Run from IIS aspnet_client or Windows Tasks Directory via process_creation

Suspicious Telerik UI RadAsyncUpload Request Indicating CVE-2019-18935 Exploitation (via webserver)

Malicious IIS Worker Process Spawning Shell for Out-of-Band Interaction via Command Line

Malicious wp2shell WordPress Exploitation via Batch Endpoint User Agent

Suspicious TOLLBOOTH Webshell URI Access

Suspicious ffuf Fuzzing Requests Against Web Server

Suspicious AI Agent Compromise via Web Worker Spawning Shell or Network Tool

Malicious wp2shell WordPress RCE via Web Server Spawning Shell Recon

Suspicious Child Process Spawned by IIS Worker Process w3wp

Django Application Error Exceptions Matching SuspiciousOperation and Security Exceptions

Pivot detection · T1190 · 9 related

Changelog

v5
Candidate ingested via manual entry.2026-07-31
v4
Candidate ingested via manual entry.2026-07-31
v3
Candidate ingested via manual entry.2026-07-31
v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

django-application-exceptions-suspicious-security-related-errors-fd435618

title: Django Application Error Exceptions Matching SuspiciousOperation and Security Exceptions
id: d4e72cea-ee5c-466c-bac8-cdad39947b2a
status: stable
description: This rule flags application log events from Django that contain exception names related to SuspiciousOperation and specific security-focused subclasses such as DisallowedHost, DisallowedRedirect, InvalidSessionKey, PermissionDenied, and RequestDataTooBig. These exceptions can occur when an attacker sends unexpected or malicious requests designed to trigger validation, authorization, or request-handling failures. The detection relies on application telemetry where Django exceptions are recorded as keyworded exception identifiers in log messages.
references:
  - https://docs.djangoproject.com/en/1.11/ref/exceptions/
  - https://docs.djangoproject.com/en/1.11/topics/logging/#django-security
  - https://github.com/SigmaHQ/sigma/blob/master/rules/application/django/appframework_django_exceptions.yml
author: Thomas Patzke, Huntrule Team
date: 2017-08-05
modified: 2020-09-01
tags:
  - attack.initial-access
  - attack.t1190
logsource:
  category: application
  product: django
detection:
  keywords:
    - SuspiciousOperation
    - DisallowedHost
    - DisallowedModelAdminLookup
    - DisallowedModelAdminToField
    - DisallowedRedirect
    - InvalidSessionKey
    - RequestDataTooBig
    - SuspiciousFileOperation
    - SuspiciousMultipartForm
    - SuspiciousSession
    - TooManyFieldsSent
    - PermissionDenied
  condition: keywords
falsepositives:
  - Application bugs
level: medium
license: DRL-1.1
related:
  - id: fd435618-981e-4a7c-81f8-f78ce480d616
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL