logging/malicious_behavior

8 notes, read out of this brain and free to use. Each one was extracted from a source and is re-checked against its exam.

malicious_excess_404 event logging

Log when a user makes numerous requests for files that don't exist (404s), indicating possible force-browsing attempts. Event name is 'malicious_excess_404' followed by userid or IP and useragent. Level is WARN. Example: event='malicious_excess404:123.456.789.101,M@l1c10us-Hax0rB0t0-v1'.

malicious_extraneous event logging

Log when backend receives unexpected input data fields not handled by the service, indicating probing for input validation errors. Event name is 'malicious_extraneous' followed by userid or IP, input field name, and useragent. Level is CRITICAL. Example: event='malicious_extraneous:dr@evil.com,creditcardnum,Mozilla/5.0...'.

malicious_attack_tool event logging

Log when obvious attack tools are identified by signature or user agent. Event name is 'malicious_attack_tool' followed by userid or IP, tool name, and useragent. Level is CRITICAL. Example: event='malicious_attack_tool:127.0.0.1,nikto,Mozilla/5.00 (Nikto/2.1.6)...'.

malicious_sqli event logging

Log SQL injection attempts detected by signature or heuristic matching with event name 'malicious_sqli' followed by userid or IP, parameter name, rule ID, and useragent. Level is CRITICAL. Avoid logging the full payload to prevent log injection risk. Log detection rule ID/category and parameter name instead. Example: event='malicious_sqli:127.0.0.1,search,SQLI-UNION,Mozilla/5.0...'.

malicious_cors event logging

Log attempts from unauthorized origins with event name 'malicious_cors' followed by userid or IP, useragent, and referer. Level is CRITICAL. Note: 'referer' is the intentional misspelling from the original HTTP specification. Example: event='malicious_cors:127.0.0.1,Mozilla/5.0...,attack.evil.com'.

malicious_direct_reference event logging

Log attempts to directly access objects without proper credentials or authorization (Insecure Direct Object Reference). Event name is 'malicious_direct_reference' followed by userid or IP and useragent. Level is CRITICAL. Example: event='malicious_direct_reference:joebob1,Mozilla/5.0...'.

malicious_csrf event logging

Log CSRF attempts detected when state-changing requests arrive without valid anti-CSRF token, or with mismatched token, Origin, or Referer. Event name is 'malicious_csrf' followed by userid or IP. Level is WARN. Block the request and log the attempt. Example: event='malicious_csrf:joebob1'.

malicious_csp_violation event logging

Log Content-Security-Policy violations reported by browsers with event name 'malicious_csp_violation' followed by userid or IP, effective directive, blocked URI, and useragent. Level is WARN (Report-Only mode) or CRITICAL (enforced mode). Strip query strings and fragments from URLs before logging to avoid logging sensitive data. Example: event='malicious_csp_violation:203.0.113.7,script-src,https://foobar.com/dashboard,Mozilla/5.0'.

Give your agent this brain