{"id":"fd435618-981e-4a7c-81f8-f78ce480d616","title":"Django Framework Exceptions","description":"Detects suspicious Django web application framework exceptions that could indicate exploitation attempts","author":"Thomas Patzke","status":"stable","level":"medium","date":"2017-08-05","modified":"2020-09-01","tags":["attack.initial-access","attack.t1190"],"technique_ids":["T1190"],"logsource":{"category":"application","product":"django"},"falsepositives":["Application bugs"],"references":["https://docs.djangoproject.com/en/1.11/ref/exceptions/","https://docs.djangoproject.com/en/1.11/topics/logging/#django-security"],"source_path":"rules/application/django/appframework_django_exceptions.yml","source_sha256":"ea4629a1e6a4ce39a726b74403f5047671fd1a8ad92382f907b8e35ab70ae25a","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/application/django/appframework_django_exceptions.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Django Framework Exceptions\nid: fd435618-981e-4a7c-81f8-f78ce480d616\nstatus: stable\ndescription: Detects suspicious Django web application framework exceptions that could indicate exploitation attempts\nreferences:\n    - https://docs.djangoproject.com/en/1.11/ref/exceptions/\n    - https://docs.djangoproject.com/en/1.11/topics/logging/#django-security\nauthor: Thomas Patzke\ndate: 2017-08-05\nmodified: 2020-09-01\ntags:\n    - attack.initial-access\n    - attack.t1190\nlogsource:\n    category: application\n    product: django\ndetection:\n    keywords:\n        - SuspiciousOperation\n        # Subclasses of SuspiciousOperation\n        - DisallowedHost\n        - DisallowedModelAdminLookup\n        - DisallowedModelAdminToField\n        - DisallowedRedirect\n        - InvalidSessionKey\n        - RequestDataTooBig\n        - SuspiciousFileOperation\n        - SuspiciousMultipartForm\n        - SuspiciousSession\n        - TooManyFieldsSent\n        # Further security-related exceptions\n        - PermissionDenied\n    condition: keywords\nfalsepositives:\n    - Application bugs\nlevel: medium\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1190","id":"T1190","name":"Exploit Public-Facing Application","page":"techniques/enterprise/T1190/"}],"data_path":"data/detection-rules/fd435618-981e-4a7c-81f8-f78ce480d616.json","kind":"sigma"}