Attack Signature Reference

Complete list of attack patterns detected by WebDecoy.

---

Overview

WebDecoy scans the request bodies captured by endpoint decoys for known attack patterns. A body is scanned when the endpoint has Capture Request Bodies turned on and the request is not a GET or HEAD. Query strings, headers and cookies are not scanned.

When a pattern matches, the signature name is added to the detection’s metadata.attack_signatures list, it raises the detection’s Attack Signatures score component, and the detection is classified as attacker. Each signature type is reported once per request, however many of its patterns match.

---

SQL Injection

Signature: sql_injection

Detection Patterns

Pattern	Example
Quoted OR/AND tautology	' OR '1'='1
UNION SELECT	UNION SELECT * FROM users
Stacked destructive statement	'; DROP TABLE users
Time-based blind	WAITFOR DELAY '0:0:5', SLEEP(5), BENCHMARK(
Trailing comment	admin'--
Inline comment	/* ... */
SQL Server procedures	xp_cmdshell, sp_executesql

Score Impact

50 component points

---

Command Injection

Signature: command_injection

Detection Patterns

Pattern	Example
Command chaining	; whoami
Pipe injection	| cat /etc/passwd
Backtick execution	`whoami`
Subshell	$(cat /etc/passwd)
Download and pipe	; curl http://... |
Shell invocation	bash -c, /bin/sh
Template expression	${...}
eval call	eval(

The chaining, pipe, backtick and subshell patterns match the commands cat, ls, id, whoami, pwd and uname.

Score Impact

60 component points

---

Cross-Site Scripting (XSS)

Signature: xss

Detection Patterns

Pattern	Example
Script tags	<script>alert('xss')</script>
Image error handler	<img src=x onerror="alert('xss')">
SVG load handler	<svg onload="alert('xss')">
Iframes	<iframe src=...>
JavaScript URIs	javascript:alert('xss')
Data URIs	data:text/html,<script>...
Event handler attributes	onerror=, onload=, onclick=, onmouseover=, onfocus=
CSS expressions	expression(

Score Impact

40 component points

---

Path Traversal

Signature: path_traversal

Detection Patterns

Pattern	Example
Dot-dot-slash	../../../etc/passwd
Dot-dot-backslash	..\..\windows
Encoded traversal	%2e%2e%2f, %2e%2e%5c
Double encoding	%252e%252e%252f
Overlong UTF-8	..%c0%af, ..%c1%9c
Sensitive Unix files	/etc/passwd, /etc/shadow
Windows paths	c:\windows, c:\boot.ini

Score Impact

50 component points

---

Mass Assignment

Signature: mass_assignment

Checked only when the request’s Content-Type is application/json.

Detection Patterns

Pattern	Example
Role escalation	"role": "admin"
Admin flags	"isAdmin": true, "is_admin": true, "admin": true
Permission lists	"permissions": [
User type	"user_type": "administrator"
Privilege fields	"privilege":, "access_level":

Score Impact

45 component points

---

XML External Entity (XXE)

Signature: xxe

Checked only when the request’s Content-Type contains xml.

Detection Patterns

Pattern	Example
DOCTYPE with entity declaration	<!DOCTYPE foo [<!ENTITY ...
SYSTEM reference to a file or URL	<!ENTITY xxe SYSTEM "file:///etc/passwd">

Score Impact

55 component points

---

Serialized Objects

Signatures: php_serialization, java_serialization

Detection Patterns

Signature	Pattern
php_serialization	Body contains a PHP serialized object (O: together with :{)
java_serialization	Body starts with rO0AB (base64 Java serialization header)

Score Impact

60 component points each

---

Detection Format

Signatures are recorded as a list of names in the detection’s metadata. The captured body is stored alongside them (truncated to 10 KB). Illustrative example (real field names):

{
  "source": "endpoint",
  "threat_category": "attacker",
  "metadata": {
    "path": "/api/v1/admin/users",
    "request_method": "POST",
    "request_body": "{\"comment\": \"<script>alert(1)</script>\", \"password\": \"' OR '1'='1\"}",
    "attack_signatures": ["sql_injection", "xss"]
  },
  "score_components": {
    "attack_signature_score": 100
  }
}

The detection’s MITRE tactic comes from the decoy path, not from the signatures. See MITRE ATT&CK Tactics.

---

Multiple Signatures

When several attack types are detected in a single request:

• Each signature adds its component points
• Each additional signature type adds a further 20 points
• The Attack Signatures component is capped at 100

The component is one weighted input to the 0-100 unified threat score. See Threat Scoring.