GitHub Repo

Detection: Unusual HTTP Request Method

Created: 2026-10-12 Last Updated: 2026-10-12 ID: c086ad2b-a747-4c61-9c90-d6ffdcaefbe8 Author: Raven Tait, Splunk Type: Anomaly Product: Splunk Enterprise Security

Description

The following analytic detects Zeek HTTP requests using methods outside a configurable allowlist of standard and commonly used HTTP methods. Unusual methods can indicate protocol abuse, exploitation attempts, or command-and-control traffic. Review the method, source, destination, and URI to assess the activity.

 1`zeek_http`
 2method=*
 3NOT method IN (
 4      "ACL",
 5      "CCM_POST",
 6      "CONNECT",
 7      "COPY",
 8      "DELETE",
 9      "GET",
10      "HEAD",
11      "LOCK",
12      "MKCOL",
13      "MOVE",
14      "OPTIONS",
15      "PATCH",
16      "POST",
17      "PRI",
18      "PROPFIND",
19      "PROPPATCH",
20      "PUT",
21      "REPORT",
22      "SEARCH",
23      "TRACE",
24      "unknown",
25      "UNLOCK"
26    )
27
28
29| eval dest_port=coalesce(dest_port, 'id.resp_p'),
30       dest=coalesce(dest, dest_ip, 'id.resp_h'),
31       src=coalesce(src, src_ip, 'id.orig_h')
32
33
34| stats count min(_time) as firstTime max(_time) as lastTime
35              values(method) as method
36              values(uri) as uri
37              values(status_code) as status_code
38
39  by src dest dest_port
40
41
42| `security_content_ctime(firstTime)`
43
44| `security_content_ctime(lastTime)`
45
46| `unusual_http_request_method_filter`

Data Source

Name Platform Sourcetype Source
Zeek HTTP Web 'zeek:http' 'http.log'

Macros Used

Name Value
zeek_http sourcetype="zeek:http"
unusual_http_request_method_filter search *
unusual_http_request_method_filter is an empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.

Annotations

- MITRE ATT&CK
+ Kill Chain Phases
+ NIST
+ CIS
- Threat Actors
ID Technique Tactic
T1071.001 Web Protocols Command and Control
T1190 Exploit Public-Facing Application Initial Access
Command and Control
Delivery
DE.AE
CIS 13

Default Configuration

This detection is configured by default in Splunk Enterprise Security to run with the following settings:

Setting Value
Disabled true
Cron Schedule 0 * * * *
Earliest Time -70m@m
Latest Time -10m@m
Schedule Window auto
Creates Finding (Notable) No
Creates Intermediate Finding (Risk Event) Yes
Anomaly detections generate Intermediate Findings (Risk Events). They do not generate a Finding (Notable) directly.

Implementation

Zeek HTTP logs must be ingested into Splunk using the latest version of Splunk Add-on for Zeek (https://splunkbase.splunk.com/app/5466). Configure the zeek_http macro to match the sourcetype used by your Zeek add-on.

Known False Positives

Some legitimate applications and frameworks may use non-standard HTTP methods. Review the method and destination to determine whether the traffic is expected, then add confirmed legitimate methods to the allowlist.

Associated Analytic Story

Intermediate Findings

Message Entity Field Entity Type Risk Score
An unusual HTTP method [$method$] ws observed from [$src$] to [$dest$] over port [$dest_port$] to URI - [$uri$]. src system 20

Threat Objects

Field Type
uri uri

References

Detection Testing

Test Type Status Dataset Source Sourcetype
Validation ✅ Passing N/A N/A N/A
Unit ✅ Passing Dataset http.log zeek:http
Integration ✅ Passing Dataset http.log zeek:http

Replay any dataset to Splunk Enterprise by using our replay.py tool or the UI. Alternatively you can replay a dataset into a Splunk Attack Range

Source: GitHub |

Version: 1