Django Framework Exceptions

Title: Django Framework Exceptions
Status: stable
Description:Detects suspicious Django web application framework exceptions that could indicate exploitation attempts
References:
  -https://docs.djangoproject.com/en/1.11/ref/exceptions/
  -https://docs.djangoproject.com/en/1.11/topics/logging/#django-security
Author: Thomas Patzke
Date: 2017-08-05
modified:2020-09-01
Tags:

• -'attack.initial-access'
• -'attack.t1190'

Logsource:

• category: application
• product: django

Detection:
  keywords:
    - 'SuspiciousOperation'
    - 'DisallowedHost'
    - 'DisallowedModelAdminLookup'
    - 'DisallowedModelAdminToField'
    - 'DisallowedRedirect'
    - 'InvalidSessionKey'
    - 'RequestDataTooBig'
    - 'SuspiciousFileOperation'
    - 'SuspiciousMultipartForm'
    - 'SuspiciousSession'
    - 'TooManyFieldsSent'
    - 'PermissionDenied'
  condition:keywords
Falsepositives:
  -Application bugs
Level: medium