Forged Web Credential Used for Unauthorized Access
This rule detects potential unauthorized access attempts using forged web credentials. It specifically looks for HTTP requests containing a cookie with a long, base64-like encoded string (100 or more characters) which could indicate a forged session token or credential. A threshold of 10 such occurrences within 5 seconds from the same destination IP address triggers the alert, suggesting a brute-force or automated credential stuffing attempt.
Suricata
