Cross-Site Scripting (XSS) Attempt via GET Request

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•1•0•28

This rule detects attempts to inject Cross-Site Scripting (XSS) payloads via GET requests in web access logs. It specifically looks for common XSS strings and encoded variations within the request URL, such as '<script>', '<iframe>', '<svg>', 'document.cookie', 'document.domain', 'onerror=', 'onresize=', 'onload=', 'onmouseover=', '${alert', 'javascript:alert', and their URL-encoded forms. The rule filters out requests that result in a 404 HTTP status code to reduce false positives.