app:web access_log
Web server access log (Apache, nginx, Tomcat, Traefik)
One line per request. Apache 'combined' and nginx 'combined' carry client IP, user, time, request line, status, bytes, Referer and User-Agent. Add X-Forwarded-For behind a proxy, and request time (Apache %D, nginx $request_time).
- Log source
- Web server logs (Apache httpd, nginx, Tomcat, Traefik)
- Host type
- Other / unclassified
- How to enable
- Apache: CustomLog logs/access_log combined (mod_log_config). nginx: access_log /var/log/nginx/access.log combined (on by default). Add '%{X-Forwarded-For}i' / '$http_x_forwarded_for' when behind a load balancer.
- Tier, host type
- Minimum
- Techniques
- 0
- Rules depending on it
- Splunk 16, Sigma 89, Elastic 9
Why this tier
ACSC web shell guidance; CISA CM0106; DISA STIG (web); NSA/ASD web shell guidance; OWASP
By role
| Role | Tier | Basis |
|---|---|---|
| Windows web server (IIS), internet-facing | Minimum | ACSC web shell guidance; CISA CM0106; DISA STIG (web); NSA/ASD web shell guidance; OWASP |
| Linux web server, internet-facing | Minimum | ACSC web shell guidance; CISA CM0106; DISA STIG (web); NSA/ASD web shell guidance; OWASP |
Techniques it helps detect
No ATT&CK analytic names this event. Its standing comes from the standards and rules below.
Rules that depend on it
Splunk 16
- Confluence Data Center and Server Privilege Escalation
- Exploit Public Facing Application via Apache Commons Text
- HTTP Rapid POST with Mixed Status Codes
- HTTP Scripting Tool User Agent
- High Volume of Bytes Out to Url
- Hunting for Log4Shell
- Jenkins Arbitrary File Read CVE-2024-23897
- Log4Shell JNDI Payload Injection Attempt
- Nginx ConnectWise ScreenConnect Authentication Bypass
- PHP Memory Exhaustion Exploitation Attempt via Multipart Request
- Spring4Shell Payload URL Request
- Tomcat Session Deserialization Attempt
- Tomcat Session File Upload Attempt
- Web JSP Request via URL
- Web Remote ShellServlet Access
- WordPress Bricks Builder plugin RCE
Sigma 89
- ADSelfService Exploitation by Tobias Michalski (Nextron Systems), Max Altgelt (Nextron Systems)
- Apache Segmentation Fault by Florian Roth (Nextron Systems)
- Apache Spark Shell Command Injection - Weblogs by Nasreddine Bencherchali (Nextron Systems)
- Apache Threading Error by Florian Roth (Nextron Systems)
- Arcadyan Router Exploitations by Bhabesh Raj
- Atlassian Bitbucket Command Injection Via Archive API by Nasreddine Bencherchali (Nextron Systems)
- CVE-2010-5278 Exploitation Attempt by Subhash Popuri (@pbssubhash)
- CVE-2020-0688 Exchange Exploitation via Web Log by Florian Roth (Nextron Systems)
- CVE-2020-0688 Exploitation Attempt by NVISO
- CVE-2020-10148 SolarWinds Orion API Auth Bypass by Bhabesh Raj, Tim Shelton
- CVE-2020-5902 F5 BIG-IP Exploitation Attempt by Florian Roth (Nextron Systems)
- CVE-2021-21972 VSphere Exploitation by Bhabesh Raj
- CVE-2021-21978 Exploitation Attempt by Bhabesh Raj
- CVE-2021-33766 Exchange ProxyToken Exploitation by Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Christian Burkard (Nextron Systems)
- CVE-2021-40539 Zoho ManageEngine ADSelfService Plus Exploit by Sittikorn S, Nuttakorn Tungpoonsup
- CVE-2021-41773 Exploitation Attempt by daffainfo, Florian Roth
- CVE-2022-31656 VMware Workspace ONE Access Auth Bypass by Nasreddine Bencherchali (Nextron Systems)
- CVE-2022-31659 VMware Workspace ONE Access RCE by Nasreddine Bencherchali (Nextron Systems)
- CVE-2023-22518 Exploitation Attempt - Vulnerable Endpoint Connection (Webserver) by Andreas Braathen (mnemonic.io)
- CVE-2023-46747 Exploitation Activity - Webserver by Nasreddine Bencherchali (Nextron Systems)
- CVE-2023-4966 Exploitation Attempt - Citrix ADC Sensitive Information Disclosure - Webserver by Nasreddine Bencherchali (Nextron Systems)
- CVE-2023-4966 Potential Exploitation Attempt - Citrix ADC Sensitive Information Disclosure - Webserver by Nasreddine Bencherchali (Nextron Systems), Michael Haag (STRT)
- CVE-2024-1212 Exploitation - Progress Kemp LoadMaster Unauthenticated Command Injection by Nasreddine Bencherchali (Nextron Systems)
- CVE-2024-1709 - ScreenConnect Authentication Bypass Exploitation by Matt Anderson, Huntress
- Cisco ASA FTD Exploit CVE-2020-3452 by Florian Roth (Nextron Systems)
- Citrix ADS Exploitation CVE-2020-8193 CVE-2020-8195 by Florian Roth (Nextron Systems)
- Citrix Netscaler Attack CVE-2019-19781 by Arnim Rupp, Florian Roth
- Confluence Exploitation CVE-2019-3398 by Florian Roth (Nextron Systems)
- Cross Site Scripting Strings by Saw Win Naung, Nasreddine Bencherchali
- DEWMODE Webshell Access by Florian Roth (Nextron Systems)
- Exchange Exploitation CVE-2021-28480 by Florian Roth (Nextron Systems)
- Exchange Exploitation Used by HAFNIUM by Florian Roth (Nextron Systems)
- Exchange ProxyShell Pattern by Florian Roth (Nextron Systems), Rich Warren
- Exploitation Attempt Of CVE-2023-46214 Using Public POC Code by Lars B. P. Frydenskov(Trifork Security)
- Exploitation of CVE-2021-26814 in Wazuh by Florian Roth (Nextron Systems)
- F5 BIG-IP iControl Rest API Command Execution - Webserver by Nasreddine Bencherchali (Nextron Systems), Thurein Oo
- Fortinet CVE-2018-13379 Exploitation by Bhabesh Raj
- Fortinet CVE-2021-22123 Exploitation by Bhabesh Raj, Florian Roth
- Grafana Path Traversal Exploitation CVE-2021-43798 by Florian Roth (Nextron Systems)
- JNDIExploit Pattern by Florian Roth (Nextron Systems)
- Java Payload Strings by frack113, Harjot Singh, "@cyb3rjy0t" (update)
- Log4j RCE CVE-2021-44228 Generic by Florian Roth (Nextron Systems)
- Log4j RCE CVE-2021-44228 in Fields by Florian Roth (Nextron Systems)
- MOVEit CVE-2023-34362 Exploitation Attempt - Potential Web Shell Request by Nasreddine Bencherchali (Nextron Systems)
- Nginx Core Dump by Florian Roth (Nextron Systems)
- OWASSRF Exploitation Attempt Using Public POC - Webserver by Nasreddine Bencherchali (Nextron Systems)
- Oracle WebLogic Exploit by Florian Roth (Nextron Systems)
- Oracle WebLogic Exploit CVE-2020-14882 by Florian Roth (Nextron Systems)
- Oracle WebLogic Exploit CVE-2021-2109 by Bhabesh Raj
- Path Traversal Exploitation Attempts by Subhash Popuri (@pbssubhash), Florian Roth (Nextron Systems), Thurein Oo, Nasreddine Bencherchali (Nextron Systems)
- Potential CVE-2021-26084 Exploitation Attempt by Sittikorn S, Nuttakorn T
- Potential CVE-2021-27905 Exploitation Attempt by @gott_cyber
- Potential CVE-2022-21587 Exploitation Attempt by Isa Almannaei
- Potential CVE-2022-46169 Exploitation Attempt by Nasreddine Bencherchali (Nextron Systems)
- Potential CVE-2023-23752 Exploitation Attempt by Bhabesh Raj
- Potential CVE-2023-25157 Exploitation Attempt by Nasreddine Bencherchali (Nextron Systems)
- Potential CVE-2023-25717 Exploitation Attempt by Nasreddine Bencherchali (Nextron Systems)
- Potential CVE-2023-27997 Exploitation Indicators by Sergio Palacios Dominguez, Nasreddine Bencherchali (Nextron Systems)
- Potential CVE-2023-46214 Exploitation Attempt by Nasreddine Bencherchali (Nextron Systems), Bhavin Patel (STRT)
- Potential Centos Web Panel Exploitation Attempt - CVE-2022-44877 by Nasreddine Bencherchali (Nextron Systems)
- Potential Exploitation of CVE-2025-4427/4428 Ivanti EPMM Pre-Auth RCE by Swachchhanda Shrawan Poudel (Nextron Systems)
- Potential Information Disclosure CVE-2023-43261 Exploitation - Web by Nasreddine Bencherchali (Nextron Systems), Thurein Oo
- Potential Java WebShell Upload in SAP NetViewer Server by Swachchhanda Shrawan Poudel (Nextron Systems)
- Potential OWASSRF Exploitation Attempt - Webserver by Nasreddine Bencherchali (Nextron Systems)
- Potential SAP NetViewer Webshell Command Execution by Swachchhanda Shrawan Poudel (Nextron Systems)
- ProxyLogon Reset Virtual Directories Based On IIS Log by frack113
- Pulse Connect Secure RCE Attack CVE-2021-22893 by Sittikorn S
- Pulse Secure Attack CVE-2019-11510 by Florian Roth (Nextron Systems)
- RedTail Cryptominer User-Agent by Marco Pedrinazzi (@pedrinazziM) (InTheCyber)
- Rejetto HTTP File Server RCE by Nasreddine Bencherchali (Nextron Systems)
- SQL Injection Strings In URI by Saw Win Naung, Nasreddine Bencherchali (Nextron Systems), Thurein Oo (Yoma Bank)
- Server Side Template Injection Strings by Nasreddine Bencherchali (Nextron Systems)
- SharePoint ToolShell CVE-2025-53770 Exploitation - Web IIS by Swachchhanda Shrawan Poudel (Nextron Systems)
- Sitecore Pre-Auth RCE CVE-2021-42237 by Florian Roth (Nextron Systems)
- Solarwinds SUPERNOVA Webshell Access by Florian Roth (Nextron Systems)
- SonicWall SSL/VPN Jarrewrite Exploitation by Florian Roth (Nextron Systems)
- Source Code Enumeration Detection by Keyword by James Ahearn
- Successful Exchange ProxyShell Attack by Florian Roth (Nextron Systems), Rich Warren
- Successful IIS Shortname Fuzzing Scan by frack113
- Suspicious User-Agents Related To Recon Tools by Nasreddine Bencherchali (Nextron Systems), Tim Shelton
- Suspicious Windows Strings In URI by Nasreddine Bencherchali (Nextron Systems)
- TerraMaster TOS CVE-2020-28188 by Bhabesh Raj
- VMware vCenter Server File Upload CVE-2021-22005 by Sittikorn S
- Webshell ReGeorg Detection Via Web Logs by Cian Heasley
- Windows Webshell Strings by Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)
- WordPress Wp2shell Exploitation Tool User-Agent by Swachchhanda Shrawan Poudel (Nextron Systems)
- WordPress Wp2shell REST Batch Endpoint Exploitation by Swachchhanda Shrawan Poudel (Nextron Systems)
- WordPress Wp2shell Webshell Plugin Access by Swachchhanda Shrawan Poudel (Nextron Systems)
- Zimbra Collaboration Suite Email Server Unauthenticated RCE by @gott_cyber
Elastic 9
- Potential HTTP Downgrade Attack
- Web Server Cloud Metadata SSRF Request
- Web Server Discovery or Fuzzing Activity
- Web Server Local File Inclusion Activity
- Web Server Potential Command Injection Request
- Web Server Potential Remote File Inclusion Activity
- Web Server Potential SQL Injection Request
- Web Server Potential Spike in Error Response Codes
- Web Server Suspicious User Agent Requests
Standards and guidance naming it
| Requirement | Relation | Basis |
|---|---|---|
| NSA and ASD: Web shell detection guidanceDetect and Prevent Web Shell Malware (CSI PP-20-0901, April 2020) | Names this event | quoted: web server access logs (Splunk sourcetype access_combined) |
| ASD ACSC: Web shell guidanceWeb Shells: Threat Awareness and Guidance (2015) | Names this event | quoted: frequency analysis on the web access logs |
| CISA: Web shell eviction countermeasureEviction Strategies Tool, CM0106 Eliminate Web Shells | Names this event | quoted: web server logs; logs to preserve: access, error |
| OWASP: Application events to logLogging Cheat Sheet | Names this event | our analysis: the access log carries the entry point URL and HTTP method OWASP asks for; application-level events need the application's own log |
| DISA STIG: Web server logging requirementsApache Server 2.4 UNIX Server V3R3 (2026-05-28) and UNIX Site V2R7 | Names this event | AS24-U1-000065 (web): CustomLog directive present |
| DISA STIG: Web server logging requirementsApache Server 2.4 UNIX Server V3R3 (2026-05-28) and UNIX Site V2R7 | Names this event | AS24-U1-000070 (web): LogFormat %a %A %h %H %l %m %s %t %u %U %{Referer}i |
| DISA STIG: Web server logging requirementsApache Server 2.4 UNIX Server V3R3 (2026-05-28) and UNIX Site V2R7 | Names this event | AS24-U2-000090 (web): LogFormat %a %A %h %H %l %m %s %t %u %U %{Referer}i (Site STIG) |
| DISA STIG: Web server logging requirementsApache Server 2.4 UNIX Server V3R3 (2026-05-28) and UNIX Site V2R7 | Names this event | AS24-U1-000130 (web): client IP, not proxy IP, behind a load balancer |
| DISA STIG: Web server logging requirementsApache Server 2.4 Windows Server V3R4 and Windows Site V2R3 (2026-04-01) | Names this event | AS24-W1-000065 (web): CustomLog Logs/access_log common |
| DISA STIG: Web server logging requirementsApache Server 2.4 Windows Server V3R4 and Windows Site V2R3 (2026-04-01) | Names this event | AS24-W1-000090 (web): LogFormat %a %A %h %H %l %m %s %t %u %U %{Referer}i |
| DISA STIG: Web server logging requirementsApache Server 2.4 Windows Server V3R4 and Windows Site V2R3 (2026-04-01) | Names this event | AS24-W1-000130 (web): client IP, not proxy IP, behind a load balancer |
| DISA STIG: Web server logging requirementsApache Server 2.4 Windows Server V3R4 and Windows Site V2R3 (2026-04-01) | Names this event | AS24-W1-000760 (web): LogFormat contains %t; timestamps mappable to UTC at one-second granularity |
| DISA SRG: Web server logging requirements (product-neutral)Web Server Security Requirements Guide V4R5 (2026-07-10) | Names this event | SRG-APP-000095 to 000100 WSR (web): event type, date and time, location, source incl. client IP behind a proxy, outcome, user identity |