{"id":"65354b83-a2ea-4ea6-8414-3ab38be0d409","title":"Cross Site Scripting Strings","description":"Detects XSS attempts injected via GET requests in access logs","author":"Saw Win Naung, Nasreddine Bencherchali","status":"test","level":"high","date":"2021-08-15","modified":"2022-06-14","tags":["attack.initial-access","attack.t1189"],"technique_ids":["T1189"],"logsource":{"category":"webserver"},"falsepositives":["JavaScripts,CSS Files and PNG files","User searches in search boxes of the respective website","Internal vulnerability scanners can cause some serious FPs when used, if you experience a lot of FPs due to this think of adding more filters such as \"User Agent\" strings and more response codes"],"references":["https://github.com/payloadbox/xss-payload-list","https://portswigger.net/web-security/cross-site-scripting/contexts"],"source_path":"rules/web/webserver_generic/web_xss_in_access_logs.yml","source_sha256":"aecf13dfffc0d341a27fa2bb93f15c54512c7ee78107195526ff3f2bece27144","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/web/webserver_generic/web_xss_in_access_logs.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Cross Site Scripting Strings\nid: 65354b83-a2ea-4ea6-8414-3ab38be0d409\nstatus: test\ndescription: Detects XSS attempts injected via GET requests in access logs\nreferences:\n    - https://github.com/payloadbox/xss-payload-list\n    - https://portswigger.net/web-security/cross-site-scripting/contexts\nauthor: Saw Win Naung, Nasreddine Bencherchali\ndate: 2021-08-15\nmodified: 2022-06-14\ntags:\n    - attack.initial-access\n    - attack.t1189\nlogsource:\n    category: webserver\ndetection:\n    select_method:\n        cs-method: 'GET'\n    keywords:\n        - '=<script>'\n        - '=%3Cscript%3E'\n        - '=%253Cscript%253E'\n        - '<iframe '\n        - '%3Ciframe '\n        - '<svg '\n        - '%3Csvg '\n        - 'document.cookie'\n        - 'document.domain'\n        - ' onerror='\n        - ' onresize='\n        - ' onload=\"'\n        - 'onmouseover='\n        - '${alert'\n        - 'javascript:alert'\n        - 'javascript%3Aalert'\n    filter:\n        sc-status: 404\n    condition: select_method and keywords and not filter\nfalsepositives:\n    - JavaScripts,CSS Files and PNG files\n    - User searches in search boxes of the respective website\n    - Internal vulnerability scanners can cause some serious FPs when used, if you experience a lot of FPs due to this think of adding more filters such as \"User Agent\" strings and more response codes\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1189","id":"T1189","name":"Drive-by Compromise","page":"techniques/enterprise/T1189/"}],"data_path":"data/detection-rules/65354b83-a2ea-4ea6-8414-3ab38be0d409.json","kind":"sigma"}