Successful IIS Shortname Fuzzing Scan

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•20

This rule detects successful attempts to exploit the IIS shortname vulnerability, which allows enumeration of folders when IIS uses an old .Net Framework. The detection logic looks for HTTP GET or OPTIONS requests to URIs containing '~1' and ending with 'a.aspx', combined with successful HTTP status codes (200 or 301). This pattern is indicative of a successful fuzzing scan for the IIS shortname vulnerability.