Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2 detections
Filters
Last updated
All Time
Detection languages
2
Contributors
2
Categories
2
2
2
Platforms
2
Products / Services
2
MITRE Techniques
18,116
15,636
12,584
8,394
6,225
This rule detects potential credential exposure by identifying HTTP requests to IIS servers (W3CIISLog) that contain keywords like 'password' or 'token' in the URI query string, with a successful status code (200). This could indicate sensitive information being passed insecurely.
This rule detects potential credential exposure by identifying HTTP requests to IIS servers (W3CIISLog) that contain keywords like 'password' or 'token' in the URI query string, with a successful status code (200). This could indicate sensitive information being passed insecurely.
