Cisco SA - Automated Web Reconnaissance via HTTP Access Errors
SPLUNK detection rule by Mahamudul Chowdhury, Bhavin Patel, Splunk · Apache-2.0
This analytic detects probable automated web reconnaissance using Cisco Secure Access proxy telemetry.
A high volume of HTTP client errors (401/403/404/etc) across many unique URLs in a short window is consistent with directory/file enumeration behavior generated by tools such as Gobuster, DirBuster, ffuf, or Burp Intruder.
Detecting this pattern helps identify pre-exploitation scanning activity, insider reconnaissance, compromised endpoints performing discovery, and attempts to find hidden administrative paths, APIs, backups, and exposed application files.
name: Cisco SA - Automated Web Reconnaissance via HTTP Access Errors
id: 4cd44520-d404-4ca8-b736-c9d6b86ecf31
version: 2
creation_date: '2026-05-08'
modification_date: '2026-06-09'
author: Mahamudul Chowdhury, Bhavin Patel, Splunk
status: production
type: Anomaly
description: |
This analytic detects probable automated web reconnaissance using Cisco Secure Access proxy telemetry.
A high volume of HTTP client errors (401/403/404/etc) across many unique URLs in a short window is consistent with directory/file enumeration behavior generated by tools such as Gobuster, DirBuster, ffuf, or Burp Intruder.
Detecting this pattern helps identify pre-exploitation scanning activity, insider reconnaissance, compromised endpoints performing discovery, and attempts to find hidden administrative paths, APIs, backups, and exposed application files.
data_source:
- Cisco Secure Access Proxy
search: |-
`cisco_secure_access_proxy`
| eval src_ip=coalesce(src_ip, src)
| eval host=coalesce(hostname, host)
| eval user=coalesce(user, identities)
| eval status=tonumber(status)
| eval domain=replace(url, "^https?://([^/]+).*$", "\\1")
| eval user_agent=coalesce(http_user_agent, user_agent)
| where status IN (400, 401, 403, 404, 405, 407, 414, 429, 431)
| bucket _time span=10m
| stats count as errors dc(url) as unique_urls values(status) as statuses values(user_agent) as user_agent values(host) as host values(user) as user by src_ip domain _time
| where errors > 100 AND unique_urls > 50
| eval firstTime=_time, lastTime=_time
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `cisco_sa___automated_web_reconnaissance_via_http_access_errors_filter`
how_to_implement: |
Ingest Cisco Secure Access proxy logs into Splunk using the Splunk Add-on for Cisco Security Cloud.
Update the `cisco_secure_access_proxy` macro so it resolves to the index, source, and sourcetype values used in your deployment.
known_false_positives: |
Aggressive web vulnerability scanners, QA automation, uptime monitoring, and authorized security assessments can generate high HTTP error volumes with large URL diversity.
Tune by allow-listing known scanner hosts, user agents, test domains, and approved assessment windows using the filter macro.
references:
- https://attack.mitre.org/techniques/T1595/
drilldown_searches:
- name: View the detection results for - "$src_ip$"
search: '%original_detection_search% | search src_ip = "$src_ip$"'
earliest_offset: $info_min_time$
latest_offset: $info_max_time$
- name: View risk events for the last 7 days for - "$src_ip$"
search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$src_ip$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
earliest_offset: 7d
latest_offset: "0"
intermediate_findings:
entities:
- field: user
type: user
score: 20
message: Source $src_ip$ triggered probable automated web reconnaissance on $domain$ with $errors$ HTTP access errors across $unique_urls$ unique URLs.
threat_objects:
- field: domain
type: domain
- field: src_ip
type: ip_address
analytic_story:
- Cisco Secure Access Analytics
asset_type: Endpoint
mitre_attack_id:
- T1595
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
category: network
security_domain: threat
tests:
- name: Cisco Secure Access Proxy True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/cisco_secure_access/proxy/automated_web_recon_http_errors.log
source: cisco_cloud_security_addon
sourcetype: cisco:cloud_security:proxy
test_type: unit
CIRCL