Potential XML External Entity (XXE) Injection Attempt

Ankit Mehta@Secvyn

•updated Jun 30, 2026•0•0•0

This rule detects potential XML External Entity (XXE) injection attempts by looking for specific XML-related keywords ('<?xml' or 'DOCTYPE') within the URI query string of IIS web server logs. It triggers an alert if three or more such attempts are observed from the same IP address within a one-hour window, indicating a possible automated scanning or attack.