Iterative SSRF Probing via High-Diversity URL Parameter Values (T1190)

Ibrahim Saud@tektrix

•updated Jun 30, 2026•1•0•1

This rule detects potential Server-Side Request Forgery (SSRF) activity by identifying suspicious patterns in web application access logs. It monitors for high-diversity parameter values within URL query strings (e.g., 'url', 'path', 'target', 'file', 'src', 'dest', 'uri', 'redirect') that deviate from normal behavior, combined with indicators like mixed HTTP response codes (2xx and 4xx) and high request volumes from a single source IP to a specific request path. Such behavior is characteristic of an adversary iteratively probing or brute-forcing internal paths or resources via an application-level vulnerability.