Detection rules › Splunk
Unusually Long Content-Type Length
The following analytic identifies unusually long strings in the Content-Type HTTP header sent by the client to the server. It uses data from the Stream:HTTP source, specifically evaluating the length of the cs_content_type field. This activity is significant because excessively long Content-Type headers can indicate attempts to exploit vulnerabilities or evade detection mechanisms. If confirmed malicious, this behavior could allow attackers to execute code, manipulate data, or bypass security controls, potentially leading to unauthorized access or data breaches.
Rule body splunk
name: Unusually Long Content-Type Length
id: 57a0a2bf-353f-40c1-84dc-29293f3c35b7
version: 7
creation_date: '2020-04-29'
modification_date: '2026-05-13'
author: Bhavin Patel, Splunk
status: experimental
type: Anomaly
description: The following analytic identifies unusually long strings in the Content-Type HTTP header sent by the client to the server. It uses data from the Stream:HTTP source, specifically evaluating the length of the `cs_content_type` field. This activity is significant because excessively long Content-Type headers can indicate attempts to exploit vulnerabilities or evade detection mechanisms. If confirmed malicious, this behavior could allow attackers to execute code, manipulate data, or bypass security controls, potentially leading to unauthorized access or data breaches.
data_source: []
search: >-
| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime from datamodel=Web by Web.src Web.dest Web.url Web.http_user_agent Web.http_content_type
| `drop_dm_object_name("Web")` | eval http_content_type_length = len(http_content_type) |
where http_content_type_length > 100
| table firstTime lastTime src dest http_content_type_length http_content_type url
http_user_agent
| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `unusually_long_content_type_length_filter`
how_to_implement: This particular search leverages data extracted from Stream:HTTP. You must configure the http stream using the Splunk Stream App on your Splunk Stream deployment server to extract the cs_content_type field.
known_false_positives: Very few legitimate Content-Type fields will have a length greater than 100 characters.
references: []
intermediate_findings:
entities:
- field: dest
type: system
score: 20
message: Unusually Long Content-Type Length ($http_content_type_length$ characters) In Web Request from $src$
- field: src
type: system
score: 20
message: Unusually Long Content-Type Length ($http_content_type_length$ characters) In Web Request from $src$
analytic_story:
- Apache Struts Vulnerability
asset_type: Web Server
mitre_attack_id: []
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
category: web
security_domain: network
Stages and Predicates
Stage 1: tstats
| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Web by Web.src Web.dest Web.url Web.http_user_agent Web.http_content_type
Stage 2: search
| `drop_dm_object_name("Web")`
Stage 3: eval
| eval http_content_type_length = len(http_content_type)
Stage 4: where
| where http_content_type_length > 100
Stage 5: table
| table firstTime lastTime src dest http_content_type_length http_content_type url http_user_agent
Stage 6: search
| `security_content_ctime(firstTime)`
Stage 7: search
| `security_content_ctime(lastTime)`
Stage 8: search
| `unusually_long_content_type_length_filter`
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
http_content_type_length | gt |
|