{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/tags/protocol-abuse/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":[],"_cs_severities":["medium"],"_cs_tags":["protocol-abuse","c2","web-exploitation","network-monitoring"],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eThis detection focuses on identifying anomalous HTTP traffic by surfacing request methods that fall outside a defined allowlist of standard operations. By monitoring Zeek HTTP logs, defenders can uncover attempts at protocol abuse, such as HTTP request smuggling, or the usage of custom, non-standard methods characteristic of proprietary command-and-control (C2) protocols.\u003c/p\u003e\n\u003cp\u003eThe scope includes any network environment utilizing Zeek for traffic analysis. Because legitimate applications and internal frameworks occasionally use non-standard HTTP methods, this detection is intended to be tuned by establishing a baseline of expected traffic and adding confirmed business-critical methods to the ignore list. It provides essential visibility into potential initial access attempts exploiting web server vulnerabilities or persistent C2 beaconing.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful attacks leveraging unusual HTTP methods can result in unauthenticated remote code execution, unauthorized data exfiltration, or persistence through covert C2 channels. The detection of these methods enables early identification of adversary infrastructure, potentially preventing compromise across enterprise web server environments.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eDeploy the provided Sigma rule to your SIEM to monitor for non-standard HTTP methods observed in Zeek logs.\u003c/li\u003e\n\u003cli\u003eReview the method, source, destination, and URI for all detected anomalies to distinguish between malicious protocol abuse and legitimate internal application traffic.\u003c/li\u003e\n\u003cli\u003eBaseline your organization's environment to identify legitimate non-standard HTTP methods used by internal frameworks and update the rule allowlist to minimize false positives.\u003c/li\u003e\n\u003cli\u003eIntegrate Zeek HTTP logs into your SIEM using the official Splunk Add-on for Zeek to ensure the \u003ccode\u003ezeek_http\u003c/code\u003e data source is correctly populated.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-13T17:41:15Z","date_published":"2026-10-13T17:41:15Z","id":"https://feed.craftedsignal.io/briefs/2026-10-unusual-http-methods/","summary":"This analytic identifies potential exploitation, command-and-control communication, or protocol abuse by monitoring Zeek logs for HTTP requests using non-standard or unexpected methods.","title":"Detection of Unusual HTTP Request Methods for Protocol Abuse","url":"https://feed.craftedsignal.io/briefs/2026-10-unusual-http-methods/"}],"language":"en","title":"CraftedSignal Threat Feed - Protocol-Abuse","version":"https://jsonfeed.org/version/1.1"}