Ruby on Rails Exception Keyword Alerts for Invalid Requests
Flags Rails ActionController exceptions in application logs that may signal probing or exploitation via invalid requests.
- Product
- ruby_on_rails
- Category
- application
- Author
- Thomas Patzke (SigmaHQ), DRL 1.1
- Published
- 2017-08-06
- Updated
- 2026-07-31
ATT&CK techniques
Initial AccessRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags application logs that contain specific Ruby on Rails ActionController exception names indicating invalid requests or request handling failures. Attackers may trigger these exceptions while probing endpoints, bypassing protections, or attempting malformed or unauthorized requests. It relies on application log telemetry where exception class strings appear in Ruby on Rails output, matching the listed exception keywords.
Reporting behind it
- edgeguides.rubyonrails.orghttp://edgeguides.rubyonrails.org/security.html
- guides.rubyonrails.orghttp://guides.rubyonrails.org/action_controller_overview.html
- stackoverflow.comhttps://stackoverflow.com/questions/25892194/does-rails-come-with-a-not-authorized-exception
- github.comhttps://github.com/rails/rails/blob/cd08e6bcc4cd8948fe01e0be1ea0c7ca60373a25/actionpack/lib/action_dispatch/middleware/exception_wrapper.rb
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/application/ruby/appframework_ruby_on_rails_exceptions.yml
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Ruby on Rails Exception Keyword Alerts for Invalid Requests
id: b985d5e9-1b47-46da-b528-10e772d9acc8
status: stable
description: This rule flags application logs that contain specific Ruby on Rails ActionController exception names indicating invalid requests or request handling failures. Attackers may trigger these exceptions while probing endpoints, bypassing protections, or attempting malformed or unauthorized requests. It relies on application log telemetry where exception class strings appear in Ruby on Rails output, matching the listed exception keywords.
references:
- http://edgeguides.rubyonrails.org/security.html
- http://guides.rubyonrails.org/action_controller_overview.html
- https://stackoverflow.com/questions/25892194/does-rails-come-with-a-not-authorized-exception
- https://github.com/rails/rails/blob/cd08e6bcc4cd8948fe01e0be1ea0c7ca60373a25/actionpack/lib/action_dispatch/middleware/exception_wrapper.rb
- https://github.com/SigmaHQ/sigma/blob/master/rules/application/ruby/appframework_ruby_on_rails_exceptions.yml
author: Thomas Patzke, Huntrule Team
date: 2017-08-06
modified: 2020-09-01
tags:
- attack.initial-access
- attack.t1190
logsource:
category: application
product: ruby_on_rails
detection:
keywords:
- ActionController::InvalidAuthenticityToken
- ActionController::InvalidCrossOriginRequest
- ActionController::MethodNotAllowed
- ActionController::BadRequest
- ActionController::ParameterMissing
condition: keywords
falsepositives:
- Application bugs
level: medium
license: DRL-1.1
related:
- id: 0d2c3d4c-4b48-4ac3-8f23-ea845746bb1a
type: derived