The scope includes any network environment utilizing Zeek for traffic analysis. Because legitimate applications and internal frameworks occasionally use non-standard HTTP methods, this detection is intended to be tuned by establishing a baseline of expected traffic and adding confirmed business-critical methods to the ignore list. It provides essential visibility into potential initial access attempts exploiting web server vulnerabilities or persistent C2 beaconing.

Impact

Successful attacks leveraging unusual HTTP methods can result in unauthenticated remote code execution, unauthorized data exfiltration, or persistence through covert C2 channels. The detection of these methods enables early identification of adversary infrastructure, potentially preventing compromise across enterprise web server environments.

Recommendation

• Deploy the provided Sigma rule to your SIEM to monitor for non-standard HTTP methods observed in Zeek logs.
• Review the method, source, destination, and URI for all detected anomalies to distinguish between malicious protocol abuse and legitimate internal application traffic.
• Baseline your organization's environment to identify legitimate non-standard HTTP methods used by internal frameworks and update the rule allowlist to minimize false positives.
• Integrate Zeek HTTP logs into your SIEM using the official Splunk Add-on for Zeek to ensure the zeek_http data source is correctly populated.