Anmol Vats
@jerryNew York CityCompletionist
0 followers192 downloads5 copies0 likes140 views
24 detections
Filters
Last updated
All Time
Detection languages
24
Categories
21
8
4
3
2
Platforms
18
8
6
5
1
Products / Services
13
11
4
1
1
MITRE Techniques
8
7
4
3
3
CVEs
1
Detects requests for files with names suggesting sensitive content (password, secret, apikey, etc.).
Detects the use of non-standard, unusual, or potentially dangerous HTTP methods within Caddy web server logs, which may indicate reconnaissance, web application exploitation, or attempts to abuse server functionalities like WebDAV.
Detects access attempts to application/error/debug log files.
Detects upload requests targeting executable or server-side script file extensions.
Detects access attempts to sensitive files such as xmlrpc.php, .htaccess, wp-config.php, /etc/shadow.
Detects HTTP upload requests directed to common web directory paths that contain suspicious file extensions, specifically archive formats (e.g., zip, rar, tar) or macro-enabled Office documents (e.g., docm, xlsm). This behavior is often associated with the delivery of malware payloads.
Detects HTTP upload attempts to web directories where a request URL contains a suspicious double file extension pattern (e.g., a web shell extension followed by an image or document extension). This technique is commonly used to bypass web server or application-level security filters that check for forbidden file types by looking at the final extension while the server might execute the underlying script.
Detects unauthorized or suspicious access attempts to common backup, database dump, or archive files via the Caddy web server, identified by specific file extensions in the requested URL.
Detects SSRF attempts targeting cloud metadata endpoints or internal/private network addresses.
Detects access to common authentication/login endpoints.
Page 2 of 3