[Rule: New] Potential Web Server Fuzzing Attempts Detected

[MakoWish]

Pull Request

Issue link(s):

Summary

This rule attempts to detect potential fuzzing attempts against web servers. Fuzzing is a malicious attempt to find misconfigurations, local file inclusions, directory traversal, or other vulnerabilities in a web service. These attempts typically generate numerous error status codes (403, 404, etc.), so this rule looks for a sequence of these status codes from the same source IP to the same destination IP.

How To Test

Checklist

• Added a label for the type of pr: bug, enhancement, schema, maintenance, Rule: New, Rule: Deprecation, Rule: Tuning, Hunt: New, or Hunt: Tuning so guidelines can be generated
• Added the meta:rapid-merge label if planning to merge within 24 hours
• Secret and sensitive material has been managed correctly
• Automated testing was updated or added to match the most common scenarios
• Documentation and comments were added for features that require explanation

Contributor checklist

• Have you signed the contributor license agreement? Yes
• Have you followed the contributor guidelines? Yes