Cyber Security: nginx Source
Source Description
This source uses nginx web server access logs. Its rules detect scanning and brute-force attempts, command and template expression injection, directory traversal, SSRF and RFI, requests from known attack tools, and sequences from reconnaissance to successful access.
The rules analyze request client addresses, methods, URIs, response codes, and User-Agent values. Some rules correlate web requests with process execution on the web server host to detect vulnerability exploitation and web shells.
Collection Requirements
- use the default access log format;
log_formatdoes not need to be changed - use the
nginxcollection configuration; see Connecting and Configuring Data Collection
MITRE ATT&CK Coverage
The source rules cover the following tactics.
- reconnaissance
- initial access
- execution
- persistence
- credential access
- discovery
- lateral movement
- command and control
Lookups
The source rules enrich incidents with context from infrastructure and account lookups, while exclusion lookups filter out legitimate activity. See Lookups for population requirements.
The "Cyber Security Expertise Description" document included with the module lists the source rules, their MITRE ATT&CK tactics and techniques, identifiers, and lookups.