some legitimate applications and frameworks may use non-standard http methods. review the method and destination to determine whether the traffic is expected, then add confirmed legitimate methods to the allowlist.

splunk

Techniques

Sample rules

Unusual HTTP Request Method

source: splunk
technicques:

Description

The following analytic detects Zeek HTTP requests using methods outside a configurable allowlist of standard and commonly used HTTP methods. Unusual methods can indicate protocol abuse, exploitation attempts, or command-and-control traffic. Review the method, source, destination, and URI to assess the activity.

Detection logic

`zeek_http`
method=*
NOT method IN (
      "ACL",
      "CCM_POST",
      "CONNECT",
      "COPY",
      "DELETE",
      "GET",
      "HEAD",
      "LOCK",
      "MKCOL",
      "MOVE",
      "OPTIONS",
      "PATCH",
      "POST",
      "PRI",
      "PROPFIND",
      "PROPPATCH",
      "PUT",
      "REPORT",
      "SEARCH",
      "TRACE",
      "unknown",
      "UNLOCK"
    )


| eval dest_port=coalesce(dest_port, 'id.resp_p'),
       dest=coalesce(dest, dest_ip, 'id.resp_h'),
       src=coalesce(src, src_ip, 'id.orig_h')


| stats count min(_time) as firstTime max(_time) as lastTime
              values(method) as method
              values(uri) as uri
              values(status_code) as status_code

  by src dest dest_port


| `security_content_ctime(firstTime)`

| `security_content_ctime(lastTime)`

| `unusual_http_request_method_filter`