Successful IIS shortname fuzzing scans via ~1 and a.aspx probe (HTTP)

title: Successful IIS shortname fuzzing scans via ~1 and a.aspx probe (HTTP)
id: 8fdb9af5-1d58-46ce-9c21-8fcf81dc411f
status: test
description: This rule flags web requests where the URL query contains the shortname pattern "~1" and ends with "a.aspx", made with HTTP GET or OPTIONS. It only triggers on successful responses (HTTP 200 or 301), indicating the probe likely reached an IIS endpoint that responded as expected. Attackers use shortname fuzzing to enumerate accessible paths and improve follow-on targeting. The detection relies on web server request URI query fields, HTTP method, and the HTTP status code.
references:
  - https://github.com/projectdiscovery/nuclei-templates/blob/9d2889356eebba661c8407038e430759dfd4ec31/fuzzing/iis-shortname.yaml
  - https://www.exploit-db.com/exploits/19525
  - https://github.com/lijiejie/IIS_shortname_Scanner
  - https://github.com/SigmaHQ/sigma/blob/master/rules/web/webserver_generic/web_iis_tilt_shortname_scan.yml
author: frack113, Huntrule Team
date: 2021-10-06
modified: 2023-01-02
tags:
  - attack.initial-access
  - attack.t1190
logsource:
  category: webserver
detection:
  selection:
    cs-uri-query|contains: ~1
    cs-uri-query|endswith: a.aspx
    cs-method:
      - GET
      - OPTIONS
    sc-status:
      - 200
      - 301
  condition: selection
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: 7cb02516-6d95-4ffc-8eee-162075e111ac
    type: derived