Detection: Investigate Suspicious Strings in HTTP Header

REMOVED DETECTION

This detection has been removed from the Splunk Threat Research content library and is no longer maintained or supported.

Reason: As of Splunk Enterprise Security version 8.0, Splunk Enterprise Security no longer supports Investigations. As such, all Investigations have been deprecated in ES Content Update.

Removed in version: 5.2.0

If you have any questions or concerns, please reach out to us at research@splunk.com.

Updated Date: 2026-05-13 ID: bc91a8cf-35e7-4bb2-8140-e756cc06fd89 Author: Bhavin Patel, Splunk Type: Investigation Product: Splunk Enterprise Security

Description

This search helps an analyst investigate a notable event related to a potential Apache Struts exploitation. To investigate, we will want to isolate and analyze the "payload" or the commands that were passed to the vulnerable hosts by creating a few regular expressions to carve out the commands focusing on common keywords from the payload, such as cmd.exe, /bin/bash and whois. The search returns these suspicious strings found in the HTTP logs of the system of interest.

Search

1`stream_http` 
2| search src_ip=$src_ip$ 
3| search dest_ip=$dest_ip$ 
4| eval cs_content_type_length = len(cs_content_type) 
5| search cs_content_type_length > 100 
6| rex field="cs_content_type" (?<suspicious_strings>cmd.exe) 
7| eval suspicious_strings_found=if(match(cs_content_type, "application"), "True", "False")  
8| rename suspicious_strings_found AS "Suspicious Content-Type Found" 
9| fields "Suspicious Content-Type Found", dest_ip, src_ip, suspicious_strings, cs_content_type, cs_content_type_length, url

Data Source

No data sources specified for this detection.

Macros Used

Name	Value
stream_http	`sourcetype=stream:http`

Annotations

- MITRE ATT&CK

+ Kill Chain Phases

+ NIST

+ CIS

- Threat Actors

ID	Technique	Tactic

Default Configuration

This detection is configured by default in Splunk Enterprise Security to run with the following settings:

Setting	Value
Disabled	true
Cron Schedule	`N/A`
Earliest Time	`N/A`
Latest Time	`N/A`
Schedule Window	`N/A`
Creates Finding (Notable)	No
Creates Intermediate Finding (Risk Event)	No

Implementation

This particular search leverages data extracted from Stream:HTTP. You must configure the http stream using the Splunk Stream App on your Splunk Stream deployment server to extract the cs_content_type field.

Known False Positives

Associated Analytic Story

Apache Struts Vulnerability

Detection Testing

Test Type	Status	Dataset	Source	Sourcetype
Validation	Not Applicable	N/A	N/A	N/A
Unit	Not Applicable	N/A	`N/A`	`N/A`
Integration	Not Applicable	N/A	`N/A`	`N/A`

Replay any dataset to Splunk Enterprise by using our replay.py tool or the UI. Alternatively you can replay a dataset into a Splunk Attack Range

Source: GitHub |

Version: 1