Sigma rule: Ruby on Rails Framework Exceptions

Rule

Title

Ruby on Rails Framework Exceptions

Status

stable

Level

medium

Author

Thomas Patzke

Date

2017-08-06

Modified

2020-09-01

File

rules/application/ruby/appframework_ruby_on_rails_exceptions.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects suspicious Ruby on Rails exceptions that could indicate exploitation attempts

Log source

product

ruby_on_rails

category

application

Detection

keywords:
    - ActionController::InvalidAuthenticityToken
    - ActionController::InvalidCrossOriginRequest
    - ActionController::MethodNotAllowed
    - ActionController::BadRequest
    - ActionController::ParameterMissing
condition: keywords

False positives (as the rule lists them)

• Application bugs

Tags

• attack.initial-access
• attack.t1190

MITRE ATT&CK ids this rule names

• T1190

References

• http://edgeguides.rubyonrails.org/security.html
• http://guides.rubyonrails.org/action_controller_overview.html
• https://stackoverflow.com/questions/25892194/does-rails-come-with-a-not-authorized-exception
• https://github.com/rails/rails/blob/cd08e6bcc4cd8948fe01e0be1ea0c7ca60373a25/actionpack/lib/action_dispatch/middleware/exception_wrapper.rb

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/application/ruby/appframework_ruby_on_rails_exceptions.yml