Webserver XSS payload strings in GET request URLs (access logs)

Finds likely XSS injection attempts in webserver GET requests by matching script, tag, and JS payload strings while excluding 404s.

FreeUnreviewedSigmahighv1

webserver-xss-payload-strings-in-get-request-urls-access-logs-65354b83

title: Webserver XSS payload strings in GET request URLs (access logs)
id: 95095461-3c9a-413f-a654-1df90c7fad39
status: test
description: This rule flags GET requests containing common cross-site scripting payload patterns such as encoded and double-encoded script tags, HTML elements, and JavaScript URI or event-handler strings. Attackers use these strings to inject malicious client-side code that can execute in a victim’s browser. The detection relies on webserver access log fields that capture the request method and URL/request content, and it excludes matches associated with HTTP 404 responses.
references:
  - https://github.com/payloadbox/xss-payload-list
  - https://portswigger.net/web-security/cross-site-scripting/contexts
  - https://github.com/SigmaHQ/sigma/blob/master/rules/web/webserver_generic/web_xss_in_access_logs.yml
author: Saw Win Naung, Nasreddine Bencherchali, Huntrule Team
date: 2021-08-15
modified: 2022-06-14
tags:
  - attack.initial-access
  - attack.t1189
logsource:
  category: webserver
detection:
  select_method:
    cs-method: GET
  keywords:
    - =<script>
    - =%3Cscript%3E
    - =%253Cscript%253E
    - "<iframe "
    - "%3Ciframe "
    - "<svg "
    - "%3Csvg "
    - document.cookie
    - document.domain
    - " onerror="
    - " onresize="
    - ' onload="'
    - onmouseover=
    - ${alert
    - javascript:alert
    - javascript%3Aalert
  filter:
    sc-status: 404
  condition: select_method and keywords and not filter
falsepositives:
  - JavaScripts,CSS Files and PNG files
  - User searches in search boxes of the respective website
  - Internal vulnerability scanners can cause some serious FPs when used, if you experience a lot of FPs due to this think of adding more filters such as "User Agent" strings and more response codes
level: high
license: DRL-1.1
related:
  - id: 65354b83-a2ea-4ea6-8414-3ab38be0d409
    type: derived

What it detects

This rule flags GET requests containing common cross-site scripting payload patterns such as encoded and double-encoded script tags, HTML elements, and JavaScript URI or event-handler strings. Attackers use these strings to inject malicious client-side code that can execute in a victim’s browser. The detection relies on webserver access log fields that capture the request method and URL/request content, and it excludes matches associated with HTTP 404 responses.

Known false positives

JavaScripts,CSS Files and PNG files
User searches in search boxes of the respective website
Internal vulnerability scanners can cause some serious FPs when used, if you experience a lot of FPs due to this think of adding more filters such as "User Agent" strings and more response codes

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.