synoti logosynoti logo
JSON Input

Detection rules for JSON Input Data sources. Every rule contains its MITRE ATT&CK mapping, an impact rating, and details on what it identifies.

This category lists 10 detection rules.

RuleCategoryTechniqueImpact (C/I/A)
GraphQL Abuse DetectionAPI AbuseT1190 - Exploit Public-Facing ApplicationC:2 / I:1 / A:1
JSON Hijacking Attempt DetectedExecutionJSON HijackingC:3 / I:2 / A:1
JSON Injection Attack AttemptDefense EvasionJSON InjectionC:3 / I:3 / A:2
JSONP Vulnerability Exploitation DetectedExecutionJSONP ExploitationC:3 / I:3 / A:1
JWT Algorithm Confusion Attack DetectionAuthentication BypassT1550 - Use Alternate Authentication MaterialC:3 / I:3 / A:1
JWT Token Security Issue DetectedDefense Evasion, Lateral MovementT1550.001 - Use Alternate Authentication Material: Application Access TokenC:3 / I:3 / A:2
Mass Assignment Attack DetectionData ManipulationT1565 - Data ManipulationC:2 / I:3 / A:1
NoSQL Injection via JSON DetectionInjection AttackT1190 - Exploit Public-Facing ApplicationC:3 / I:3 / A:2
Prototype Pollution Attempt DetectedDefense Evasion, Privilege EscalationPrototype PollutionC:2 / I:3 / A:2
Unsafe Deserialization Attack DetectedInitial AccessT1190 - Exploit Public-Facing ApplicationC:3 / I:3 / A:2

Rule Example

Below is an example of a rule definition for GraphQL Abuse Detection (view in repository):

# Rule version v1.0.0

dataTypes:
  - json-input
name: GraphQL Abuse Detection
impact:
  confidentiality: 2
  integrity: 1
  availability: 1
category: API Abuse
technique: "T1190 - Exploit Public-Facing Application"
adversary: origin
references:
  - https://cheatsheetseries.owasp.org/cheatsheets/GraphQL_Cheat_Sheet.html
  - https://attack.mitre.org/techniques/T1190/
description: |
  Detects GraphQL abuse patterns including introspection queries, query batching, deeply nested queries for DoS, and unauthorized schema discovery. These techniques are used to enumerate APIs and exploit GraphQL endpoints.

  Next Steps:
  1. Review the GraphQL queries for malicious patterns
  2. Check if introspection queries exposed the schema
  3. Verify if query batching was used for brute force
  4. Implement query depth limiting and complexity analysis
  5. Disable introspection in production environments
  6. Deploy rate limiting for GraphQL endpoints
where: |
  exists("origin.ip") &&
  (
    regexMatch("raw", "(?i)\\{\\s*__schema\\s*\\{") ||
    contains("raw", "IntrospectionQuery") ||
    contains("raw", "introspectionQuery") ||
    regexMatch("raw", "(?i)(query|mutation)\\s*\\{.*\\{.*\\{.*\\{.*\\{.*\\{.*\\{")
  )
afterEvents:
  - indexPattern: v1-7-22-log-json-input-*
    with:
      - field: origin.ip
        operator: filter_term
        value: '{{.origin.ip}}'
    within: now-15m
    count: 5
groupBy:
  - adversary.ip
  - target.host

Rule Details

GraphQL Abuse Detection

Identifies GraphQL abuse patterns such as introspection queries, batched queries, deeply nested queries used for DoS, and unauthorized schema discovery. These methods are employed to enumerate APIs and exploit GraphQL endpoints.

JSON Hijacking Attempt Detected

Identifies efforts to hijack JSON data via malicious script tags, Array constructor overrides, or patterns of cross-domain data theft. JSON hijacking attacks seek to steal sensitive data by leveraging flaws in JSON responses through script tag inclusion or prototype manipulation.

JSON Injection Attack Attempt

Identifies possible JSON injection attempts such as malicious payloads, script injections, and efforts to alter JSON structure. Such attacks may result in XSS, authentication bypass, or remote code execution.

JSONP Vulnerability Exploitation Detected

Identifies efforts to exploit JSONP endpoints via callback manipulation, XSS injection through callbacks, or cross-domain data access without authorization. This rule detects malicious callback parameters that contain script tags, JavaScript execution functions, or non-standard callback names, which may signal exploitation attempts.

JWT Algorithm Confusion Attack Detection

Identifies JWT algorithm confusion attacks such as alg:none bypass, RS256 to HS256 key confusion, and forged JWT tokens. These attacks target JWT libraries that fail to validate the algorithm header correctly.

JWT Token Security Issue Detected

Identifies JWT token security problems such as algorithm confusion, use of the none algorithm, expired tokens, invalid signatures, or efforts to manipulate tokens. These weaknesses may result in authentication bypass and unauthorized access to protected resources.

Mass Assignment Attack Detection

Identifies mass assignment attacks in which unexpected fields such as isAdmin, role, permissions, or password are injected into JSON request bodies. Attackers abuse API endpoints that blindly map user input to object properties.

NoSQL Injection via JSON Detection

Identifies MongoDB-style NoSQL injection patterns in JSON payloads such as $gt, $ne, $regex, $where, and other operator-based injection methods. These attacks circumvent authentication or extract data from NoSQL databases.

Prototype Pollution Attempt Detected

Detects attempts to pollute JavaScript object prototypes through malicious JSON input containing proto, constructor, or prototype attributes. This technique can compromise the application by modifying the behavior of all objects within it.

Unsafe Deserialization Attack Detected

Identifies efforts to exploit unsafe deserialization flaws via malicious JSON payloads that contain serialized objects or code execution patterns. Such attacks may result in remote code execution, privilege escalation, or data compromise.