SSRF Probe via Unauthenticated url= Parameter with IAM Correlation

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•1

This rule detects potential Server-Side Request Forgery (SSRF) probing attempts against web applications where unauthenticated requests contain a URL parameter used to request external or internal resources. It flags high-volume probing activity and correlates the source IP with concurrent anomalous Azure Active Directory (Azure AD) sign-in events from the same source, such as failed logins or high-risk sign-in attempts.