app:web

Web server logs (Apache httpd, nginx, Tomcat, Traefik)

Event keys: access_log, error_log, modsecurity_audit, forensic_log

Host type: Other / unclassified
Techniques: 3
Rules listed: 118
Events: 4

Standards and guidance naming this source

Requirement	Relation	Basis
ASD ACSC / CISA et al.: Priority enterprise log sources	priority_source	quoted: internet-facing services, including remote access, network metadata; user application logs
DISA SRG: Web server logging requirements (product-neutral)	applies_to	SRG-APP-000089/000092 WSR (web): log startup, shutdown, access and authentication events; session logging at startup

Techniques

Rules

Splunk 16

Sigma 89

ADSelfService Exploitation by Tobias Michalski (Nextron Systems), Max Altgelt (Nextron Systems)
Apache Segmentation Fault by Florian Roth (Nextron Systems)
Apache Spark Shell Command Injection - Weblogs by Nasreddine Bencherchali (Nextron Systems)
Apache Threading Error by Florian Roth (Nextron Systems)
Arcadyan Router Exploitations by Bhabesh Raj
Atlassian Bitbucket Command Injection Via Archive API by Nasreddine Bencherchali (Nextron Systems)
CVE-2010-5278 Exploitation Attempt by Subhash Popuri (@pbssubhash)
CVE-2020-0688 Exchange Exploitation via Web Log by Florian Roth (Nextron Systems)
CVE-2020-0688 Exploitation Attempt by NVISO
CVE-2020-10148 SolarWinds Orion API Auth Bypass by Bhabesh Raj, Tim Shelton
CVE-2020-5902 F5 BIG-IP Exploitation Attempt by Florian Roth (Nextron Systems)
CVE-2021-21972 VSphere Exploitation by Bhabesh Raj
CVE-2021-21978 Exploitation Attempt by Bhabesh Raj
CVE-2021-33766 Exchange ProxyToken Exploitation by Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Christian Burkard (Nextron Systems)
CVE-2021-40539 Zoho ManageEngine ADSelfService Plus Exploit by Sittikorn S, Nuttakorn Tungpoonsup
CVE-2021-41773 Exploitation Attempt by daffainfo, Florian Roth
CVE-2022-31656 VMware Workspace ONE Access Auth Bypass by Nasreddine Bencherchali (Nextron Systems)
CVE-2022-31659 VMware Workspace ONE Access RCE by Nasreddine Bencherchali (Nextron Systems)
CVE-2023-22518 Exploitation Attempt - Vulnerable Endpoint Connection (Webserver) by Andreas Braathen (mnemonic.io)
CVE-2023-46747 Exploitation Activity - Webserver by Nasreddine Bencherchali (Nextron Systems)
CVE-2023-4966 Exploitation Attempt - Citrix ADC Sensitive Information Disclosure - Webserver by Nasreddine Bencherchali (Nextron Systems)
CVE-2023-4966 Potential Exploitation Attempt - Citrix ADC Sensitive Information Disclosure - Webserver by Nasreddine Bencherchali (Nextron Systems), Michael Haag (STRT)
CVE-2024-1212 Exploitation - Progress Kemp LoadMaster Unauthenticated Command Injection by Nasreddine Bencherchali (Nextron Systems)
CVE-2024-1709 - ScreenConnect Authentication Bypass Exploitation by Matt Anderson, Huntress
Cisco ASA FTD Exploit CVE-2020-3452 by Florian Roth (Nextron Systems)
Citrix ADS Exploitation CVE-2020-8193 CVE-2020-8195 by Florian Roth (Nextron Systems)
Citrix Netscaler Attack CVE-2019-19781 by Arnim Rupp, Florian Roth
Confluence Exploitation CVE-2019-3398 by Florian Roth (Nextron Systems)
Cross Site Scripting Strings by Saw Win Naung, Nasreddine Bencherchali
DEWMODE Webshell Access by Florian Roth (Nextron Systems)
Exchange Exploitation CVE-2021-28480 by Florian Roth (Nextron Systems)
Exchange Exploitation Used by HAFNIUM by Florian Roth (Nextron Systems)
Exchange ProxyShell Pattern by Florian Roth (Nextron Systems), Rich Warren
Exploitation Attempt Of CVE-2023-46214 Using Public POC Code by Lars B. P. Frydenskov(Trifork Security)
Exploitation of CVE-2021-26814 in Wazuh by Florian Roth (Nextron Systems)
F5 BIG-IP iControl Rest API Command Execution - Webserver by Nasreddine Bencherchali (Nextron Systems), Thurein Oo
Fortinet CVE-2018-13379 Exploitation by Bhabesh Raj
Fortinet CVE-2021-22123 Exploitation by Bhabesh Raj, Florian Roth
Grafana Path Traversal Exploitation CVE-2021-43798 by Florian Roth (Nextron Systems)
JNDIExploit Pattern by Florian Roth (Nextron Systems)
Java Payload Strings by frack113, Harjot Singh, "@cyb3rjy0t" (update)
Log4j RCE CVE-2021-44228 Generic by Florian Roth (Nextron Systems)
Log4j RCE CVE-2021-44228 in Fields by Florian Roth (Nextron Systems)
MOVEit CVE-2023-34362 Exploitation Attempt - Potential Web Shell Request by Nasreddine Bencherchali (Nextron Systems)
Nginx Core Dump by Florian Roth (Nextron Systems)
OWASSRF Exploitation Attempt Using Public POC - Webserver by Nasreddine Bencherchali (Nextron Systems)
Oracle WebLogic Exploit by Florian Roth (Nextron Systems)
Oracle WebLogic Exploit CVE-2020-14882 by Florian Roth (Nextron Systems)
Oracle WebLogic Exploit CVE-2021-2109 by Bhabesh Raj
Path Traversal Exploitation Attempts by Subhash Popuri (@pbssubhash), Florian Roth (Nextron Systems), Thurein Oo, Nasreddine Bencherchali (Nextron Systems)
Potential CVE-2021-26084 Exploitation Attempt by Sittikorn S, Nuttakorn T
Potential CVE-2021-27905 Exploitation Attempt by @gott_cyber
Potential CVE-2022-21587 Exploitation Attempt by Isa Almannaei
Potential CVE-2022-46169 Exploitation Attempt by Nasreddine Bencherchali (Nextron Systems)
Potential CVE-2023-23752 Exploitation Attempt by Bhabesh Raj
Potential CVE-2023-25157 Exploitation Attempt by Nasreddine Bencherchali (Nextron Systems)
Potential CVE-2023-25717 Exploitation Attempt by Nasreddine Bencherchali (Nextron Systems)
Potential CVE-2023-27997 Exploitation Indicators by Sergio Palacios Dominguez, Nasreddine Bencherchali (Nextron Systems)
Potential CVE-2023-46214 Exploitation Attempt by Nasreddine Bencherchali (Nextron Systems), Bhavin Patel (STRT)
Potential Centos Web Panel Exploitation Attempt - CVE-2022-44877 by Nasreddine Bencherchali (Nextron Systems)
Potential Exploitation of CVE-2025-4427/4428 Ivanti EPMM Pre-Auth RCE by Swachchhanda Shrawan Poudel (Nextron Systems)
Potential Information Disclosure CVE-2023-43261 Exploitation - Web by Nasreddine Bencherchali (Nextron Systems), Thurein Oo
Potential Java WebShell Upload in SAP NetViewer Server by Swachchhanda Shrawan Poudel (Nextron Systems)
Potential OWASSRF Exploitation Attempt - Webserver by Nasreddine Bencherchali (Nextron Systems)
Potential SAP NetViewer Webshell Command Execution by Swachchhanda Shrawan Poudel (Nextron Systems)
ProxyLogon Reset Virtual Directories Based On IIS Log by frack113
Pulse Connect Secure RCE Attack CVE-2021-22893 by Sittikorn S
Pulse Secure Attack CVE-2019-11510 by Florian Roth (Nextron Systems)
RedTail Cryptominer User-Agent by Marco Pedrinazzi (@pedrinazziM) (InTheCyber)
Rejetto HTTP File Server RCE by Nasreddine Bencherchali (Nextron Systems)
SQL Injection Strings In URI by Saw Win Naung, Nasreddine Bencherchali (Nextron Systems), Thurein Oo (Yoma Bank)
Server Side Template Injection Strings by Nasreddine Bencherchali (Nextron Systems)
SharePoint ToolShell CVE-2025-53770 Exploitation - Web IIS by Swachchhanda Shrawan Poudel (Nextron Systems)
Sitecore Pre-Auth RCE CVE-2021-42237 by Florian Roth (Nextron Systems)
Solarwinds SUPERNOVA Webshell Access by Florian Roth (Nextron Systems)
SonicWall SSL/VPN Jarrewrite Exploitation by Florian Roth (Nextron Systems)
Source Code Enumeration Detection by Keyword by James Ahearn
Successful Exchange ProxyShell Attack by Florian Roth (Nextron Systems), Rich Warren
Successful IIS Shortname Fuzzing Scan by frack113
Suspicious User-Agents Related To Recon Tools by Nasreddine Bencherchali (Nextron Systems), Tim Shelton
Suspicious Windows Strings In URI by Nasreddine Bencherchali (Nextron Systems)
TerraMaster TOS CVE-2020-28188 by Bhabesh Raj
VMware vCenter Server File Upload CVE-2021-22005 by Sittikorn S
Webshell ReGeorg Detection Via Web Logs by Cian Heasley
Windows Webshell Strings by Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)
WordPress Wp2shell Exploitation Tool User-Agent by Swachchhanda Shrawan Poudel (Nextron Systems)
WordPress Wp2shell REST Batch Endpoint Exploitation by Swachchhanda Shrawan Poudel (Nextron Systems)
WordPress Wp2shell Webshell Plugin Access by Swachchhanda Shrawan Poudel (Nextron Systems)
Zimbra Collaboration Suite Email Server Unauthenticated RCE by @gott_cyber

Elastic 13

Events

Minimum (1)

access_logWeb server access log (Apache, nginx, Tomcat, Traefik)

Recommended (1)

error_logWeb server error log

Listed (2)

forensic_logApache mod_log_forensic
modsecurity_auditModSecurity audit log (WAF on the host)