Name:Unusual HTTP Request Method id:c086ad2b-a747-4c61-9c90-d6ffdcaefbe8 version:1 date:None author:Raven Tait, Splunk status:production type:Anomaly Description:The following analytic detects Zeek HTTP requests using methods outside a configurable allowlist of standard and commonly used HTTP methods.
Unusual methods can indicate protocol abuse, exploitation attempts, or command-and-control traffic.
Review the method, source, destination, and URI to assess the activity. Data_source:
how_to_implement:Zeek HTTP logs must be ingested into Splunk using the latest version of Splunk Add-on for Zeek (https://splunkbase.splunk.com/app/5466).
Configure the `zeek_http` macro to match the sourcetype used by your Zeek add-on. known_false_positives:Some legitimate applications and frameworks may use non-standard HTTP methods.
Review the method and destination to determine whether the traffic is expected, then add confirmed legitimate methods to the allowlist. References: -https://attack.mitre.org/techniques/T1071/001/ -https://attack.mitre.org/techniques/T1190/ -https://developer.mozilla.org/en-US/docs/Web/HTTP/Methods drilldown_searches: name:'View the detection results for - "$src$"' search:'%original_detection_search% | search src = "$src$"' earliest_offset:'$info_min_time$' latest_offset:'$info_max_time$' name:'View risk events for the last 7 days for - "$id.orig_h$"' search:'| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$src$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset:'7d' latest_offset:'0' analytic_story:['Command And Control', 'HTTP Request Smuggling']
