HTTP: IIS Single Encoding (2)

This signature detects a single digit encoded in a URL. Microsoft Internet Information Services (IIS) uses special techniques to decode URLs. Attackers can be attempting to exploit these IIS techniques to evade detection by IDP.

Extended Description

An HTTP request in which the Unicode-encoded forms of the "/" or "\" delimiter characters exist in a requested URL constitutes a protocol anomaly. The condition could be the result of a software error, or it could indicate malicious activity involving intentional transmission of Unicode-encoded delimiter strings is underway.

References

URL: http://www.idsresearch.org/http_evasions.html

Short Name

HTTP:IIS:ENCODING:SINGLE-DIG-2

Severity

Minor

Recommended

False

Recommended Action

Drop

HTTP: IIS Single Encoding (2)

Extended Description

References

Found a potential security threat?