high
advisory
Web Server: Server Side Template Injection (SSTI) attempts
Detection logic for identifying Server Side Template Injection (SSTI) attempts within web server access logs by monitoring for common template syntax in GET requests.
Triage facts
Revision 1- Evidence
- Unknown
- Severity
- High
- Sources
- 3 public sources
- Freshness
- Revision 1Nov 10, 02:40 UTC
- Detection
- 1 rule
- Source quality
- A2Roughly even chance
This intelligence covers patterns associated with Server Side Template Injection (SSTI) attacks. The detection focuses on identifying template expression prefixes within GET request query parameters as defined by existing Sigma detection criteria.
False Positives
- User searches in search boxes of the respective website.
- Internal vulnerability scanners. If false positives occur, consider adding filters such as "User Agent" strings or response codes.
Detection coverage 1
Detect Server Side Template Injection (SSTI) Attempts
highsigma
tactics: stealth
techniques: T1221
sources: webserver
Detection queries are available on the platform. Get full rules →