Ruby on Rails application exceptions indicating invalid requests

title: Ruby on Rails application exceptions indicating invalid requests
id: b985d5e9-1b47-46da-b528-10e772d9acc8
status: stable
description: This rule identifies Ruby on Rails application error events containing specific ActionController exception names. Such exceptions can be triggered by malformed or unauthorized requests during probing or exploitation attempts. It relies on application log text that includes the referenced Rails exception keywords to surface suspicious request-handling failures.
references:
  - http://edgeguides.rubyonrails.org/security.html
  - http://guides.rubyonrails.org/action_controller_overview.html
  - https://stackoverflow.com/questions/25892194/does-rails-come-with-a-not-authorized-exception
  - https://github.com/rails/rails/blob/cd08e6bcc4cd8948fe01e0be1ea0c7ca60373a25/actionpack/lib/action_dispatch/middleware/exception_wrapper.rb
  - https://github.com/SigmaHQ/sigma/blob/master/rules/application/ruby/appframework_ruby_on_rails_exceptions.yml
author: Thomas Patzke, Huntrule Team
date: 2017-08-06
modified: 2020-09-01
tags:
  - attack.initial-access
  - attack.t1190
logsource:
  category: application
  product: ruby_on_rails
detection:
  keywords:
    - ActionController::InvalidAuthenticityToken
    - ActionController::InvalidCrossOriginRequest
    - ActionController::MethodNotAllowed
    - ActionController::BadRequest
    - ActionController::ParameterMissing
  condition: keywords
falsepositives:
  - Application bugs
level: medium
license: DRL-1.1
related:
  - id: 0d2c3d4c-4b48-4ac3-8f23-ea845746bb1a
    type: derived