Webserver: Successful IIS shortname fuzzing scan using "~1" parameter

Alerts on successful IIS probing requests containing ~1 and ending with a.aspx using GET/OPTIONS.

FreeReviewedSigma · Medium · v2

Category: webserver
Author: frack113 (SigmaHQ), DRL 1.1
Published: 2021-10-06
Updated: 2026-07-31

ATT&CK techniques

Initial Access

Recon
Resource Dev
Initial Access
- T1190Exploit Public-Facing Application
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule identifies HTTP requests made to a web server that include a shortname-style path fragment ("~1") in the query string and target an ending of "a.aspx". It only matches responses with status codes 200 or 301, indicating the scan reached content and/or was redirected successfully. Attackers may use this behavior to enumerate accessible directories or files on IIS instances that are vulnerable due to legacy handling of shortname patterns. Telemetry relied on is HTTP request fields (URI query, method) and HTTP response status (sc-status).

Reporting behind it

Related detections9 linkedT1190 — drag to rearrange

Malicious MS-SQL Server Spawning Command Shell via Mallox

Malicious ActiveMQ CVE-2023-46604 Payload Download via curl or wget

Malicious WordPress Core SQL Injection Scanner via User-Agent

Malicious Command Shell Spawned by SQL Server via Process Creation (via process_creation)

Malicious Command Shell or PowerShell Spawned by Tomcat via Process Creation (via process_creation)

Suspicious Shell Script Execution From Temp Directory on SonicWall SMA1000 Appliance (via process_creation)

Possible TP-Link Command Injection via WlanNetworkRpm Endpoint (via webserver)

Malicious SharePoint ToolPane Exploitation via SignOut Referer

Suspicious Tomcat Session Deserialization Trigger via Crafted JSESSIONID

Webserver: Successful IIS shortname fuzzing scan using "~1" parameter

Pivot detection · T1190 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

successful-iis-shortname-fuzzing-scans-via-1-and-a-aspx-probe-http-7cb02516

title: 'Webserver: Successful IIS shortname fuzzing scan using "~1" parameter'
id: 8fdb9af5-1d58-46ce-9c21-8fcf81dc411f
status: test
description: This rule identifies HTTP requests made to a web server that include a shortname-style path fragment ("~1") in the query string and target an ending of "a.aspx". It only matches responses with status codes 200 or 301, indicating the scan reached content and/or was redirected successfully. Attackers may use this behavior to enumerate accessible directories or files on IIS instances that are vulnerable due to legacy handling of shortname patterns. Telemetry relied on is HTTP request fields (URI query, method) and HTTP response status (sc-status).
references:
  - https://github.com/projectdiscovery/nuclei-templates/blob/9d2889356eebba661c8407038e430759dfd4ec31/fuzzing/iis-shortname.yaml
  - https://www.exploit-db.com/exploits/19525
  - https://github.com/lijiejie/IIS_shortname_Scanner
  - https://github.com/SigmaHQ/sigma/blob/master/rules/web/webserver_generic/web_iis_tilt_shortname_scan.yml
author: frack113, Huntrule Team
date: 2021-10-06
modified: 2023-01-02
tags:
  - attack.initial-access
  - attack.t1190
logsource:
  category: webserver
detection:
  selection:
    cs-uri-query|contains: ~1
    cs-uri-query|endswith: a.aspx
    cs-method:
      - GET
      - OPTIONS
    sc-status:
      - 200
      - 301
  condition: selection
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: 7cb02516-6d95-4ffc-8eee-162075e111ac
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL