Anmol Vats
@jerryNew York CityCompletionist
0 followers192 downloads5 copies0 likes133 views
24 detections
Filters
Last updated
All Time
Detection languages
24
Categories
21
8
4
3
2
Platforms
18
8
6
5
1
Products / Services
13
11
4
1
1
MITRE Techniques
8
7
4
3
3
CVEs
1
Detects anomalous URL-encoding patterns in requests handled by the Caddy web server. The rule uses regex to identify potentially malicious representations of path traversal characters and separators, such as double encoding or unusual Unicode mappings, which are frequently leveraged to bypass Web Application Firewalls (WAF) or path-based security filters.
Detects JNDI lookup patterns associated with Log4Shell (CVE-2021-44228) exploitation attempts.
Detects abnormally long request URIs, often indicating fuzzing or buffer-overflow probing.
Detects User-Agent strings belonging to common attack/scanning tools.
Detects cross-site scripting payloads in the request URI.
Detects common SQL injection attack patterns such as UNION SELECT, OR 1=1, DROP TABLE, and others within the request URI of Caddy web server logs.
Detects empty, placeholder, or abnormally long User-Agent headers often used to evade fingerprinting.
Detects probing of common sensitive paths such as .env, .git, wp-admin, phpmyadmin.
Detects local/remote file inclusion attempts via php wrappers and similar schemes.
Detects incoming HTTP requests to a Caddy web server using the TRACE or TRACK methods. These methods are rarely used in legitimate production traffic and are frequently associated with Cross-Site Tracing (XST) attempts, which can be used to bypass security controls and steal sensitive data such as cookies.
Page 1 of 3