Webserver GET requests containing XSS-related payload strings

ATT&CK techniques

Initial Access

Recon
Resource Dev
Initial Access
- T1189Drive-by Compromise
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags webserver access log entries for GET requests that include common XSS injection patterns such as encoded and double-encoded <script>, <iframe>, <svg> payloads and JavaScript event handlers or alert invocations. Attackers often use these crafted strings in query parameters to trigger script execution in other users’ browsers. The detection relies on HTTP method, matched keyword substrings, and excludes events with a 404 status.

Reporting behind it

Related detections6 linkedT1189 — drag to rearrange

Suspicious Connection to Local Zoom Opener Webserver Launch Endpoint (via network_connection)

Suspicious macOS Installer Invocation Spawned via Zoom Opener Helper (via process_creation)

Suspicious FakeBat Fake Browser Update Stats and Download Endpoints (via proxy)

Suspicious Watering Hole Exfiltration to Fake wp-includes Endpoint via SilentSelfie

Suspicious Child Processes Spawned by Browsers on macOS

Proxy Web Requests for Flash Player Installer from Unofficial Locations

Webserver GET requests containing XSS-related payload strings

Pivot detection · T1189 · 6 related

Changelog

v2

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

webserver-xss-payload-strings-in-get-request-urls-access-logs-65354b83

title: Webserver GET requests containing XSS-related payload strings
id: 95095461-3c9a-413f-a654-1df90c7fad39
status: test
description: This rule flags webserver access log entries for GET requests that include common XSS injection patterns such as encoded and double-encoded <script>, <iframe>, <svg> payloads and JavaScript event handlers or alert invocations. Attackers often use these crafted strings in query parameters to trigger script execution in other users’ browsers. The detection relies on HTTP method, matched keyword substrings, and excludes events with a 404 status.
references:
  - https://github.com/payloadbox/xss-payload-list
  - https://portswigger.net/web-security/cross-site-scripting/contexts
  - https://github.com/SigmaHQ/sigma/blob/master/rules/web/webserver_generic/web_xss_in_access_logs.yml
author: Saw Win Naung, Nasreddine Bencherchali, Huntrule Team
date: 2021-08-15
modified: 2022-06-14
tags:
  - attack.initial-access
  - attack.t1189
logsource:
  category: webserver
detection:
  select_method:
    cs-method: GET
  keywords:
    - =<script>
    - =%3Cscript%3E
    - =%253Cscript%253E
    - "<iframe "
    - "%3Ciframe "
    - "<svg "
    - "%3Csvg "
    - document.cookie
    - document.domain
    - " onerror="
    - " onresize="
    - ' onload="'
    - onmouseover=
    - ${alert
    - javascript:alert
    - javascript%3Aalert
  filter:
    sc-status: 404
  condition: select_method and keywords and not filter
falsepositives:
  - JavaScripts,CSS Files and PNG files
  - User searches in search boxes of the respective website
  - Internal vulnerability scanners can cause some serious FPs when used, if you experience a lot of FPs due to this think of adding more filters such as "User Agent" strings and more response codes
level: high
license: DRL-1.1
related:
  - id: 65354b83-a2ea-4ea6-8414-3ab38be0d409
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL