Detection of Unusual HTTP Request Methods for Protocol Abuse

This detection focuses on identifying anomalous HTTP traffic by surfacing request methods that fall outside a defined allowlist of standard operations. By monitoring Zeek HTTP logs, defenders can uncover attempts at protocol abuse, such as HTTP request smuggling, or the usage of custom, non-standard methods characteristic of proprietary command-and-control (C2) protocols.

The scope includes any network environment utilizing Zeek for traffic analysis. Because legitimate applications and internal frameworks occasionally use non-standard HTTP methods, this detection is intended to be tuned by establishing a baseline of expected traffic and adding confirmed business-critical methods to the ignore list. It provides essential visibility into potential initial access attempts exploiting web server vulnerabilities or persistent C2 beaconing.

Impact

Successful attacks leveraging unusual HTTP methods can result in unauthenticated remote code execution, unauthorized data exfiltration, or persistence through covert C2 channels. The detection of these methods enables early identification of adversary infrastructure, potentially preventing compromise across enterprise web server environments.

Recommendation

• Deploy the provided Sigma rule to your SIEM to monitor for non-standard HTTP methods observed in Zeek logs.
• Review the method, source, destination, and URI for all detected anomalies to distinguish between malicious protocol abuse and legitimate internal application traffic.
• Baseline your organization's environment to identify legitimate non-standard HTTP methods used by internal frameworks and update the rule allowlist to minimize false positives.
• Integrate Zeek HTTP logs into your SIEM using the official Splunk Add-on for Zeek to ensure the zeek_http data source is correctly populated.