Ruby on Rails framework exceptions

Detects suspicious Ruby on Rails exceptions that could indicate exploitation attempts

Rule Content

- title: Ruby on Rails framework exceptions
  id: 0d2c3d4c-4b48-4ac3-8f23-ea845746bb1a
  description: Detects suspicious Ruby on Rails exceptions that could indicate exploitation
    attempts
  author: Thomas Patzke
  references:
  - http://edgeguides.rubyonrails.org/security.html
  - http://guides.rubyonrails.org/action_controller_overview.html
  - https://stackoverflow.com/questions/25892194/does-rails-come-with-a-not-authorized-exception
  - https://github.com/rails/rails/blob/master/actionpack/lib/action_dispatch/middleware/exception_wrapper.rb
  logsource:
    category: application
    product: ruby_on_rails
    service: null
  detection:
    keywords:
    - ActionController::InvalidAuthenticityToken
    - ActionController::InvalidCrossOriginRequest
    - ActionController::MethodNotAllowed
    - ActionController::BadRequest
    - ActionController::ParameterMissing
    condition: keywords
  falsepositives:
  - Application bugs
  - Penetration testing
  level: medium

Querying Elasticsearch

Import Libraries



In [ ]:

    
from elasticsearch import Elasticsearch
from elasticsearch_dsl import Search
import pandas as pd

Initialize Elasticsearch client



In [ ]:

    
es = Elasticsearch(['http://helk-elasticsearch:9200'])
searchContext = Search(using=es, index='logs-*', doc_type='doc')

Run Elasticsearch Query



In [ ]:

    
s = searchContext.query('query_string', query='\*.keyword:(*ActionController\:\:InvalidAuthenticityToken* OR *ActionController\:\:InvalidCrossOriginRequest* OR *ActionController\:\:MethodNotAllowed* OR *ActionController\:\:BadRequest* OR *ActionController\:\:ParameterMissing*)')
response = s.execute()
if response.success():
    df = pd.DataFrame((d.to_dict() for d in s.scan()))

Show Results



In [ ]:

    
df.head()