apm | Detection.FYI

Web Application Suspicious Activity: POST Request Declined

Sep 19, 2026 · Data Source: APM Resources: Investigation Guide Noise: High Performance: Normal Profile: Aggressive Rule Type: Custom Query (KQL) ·

Share on:

A POST request to a web application returned a 403 response, which indicates the web application declined to process the request because the action requested was not allowed.

Web Application Suspicious Activity: sqlmap User Agent

Sep 19, 2026 · Data Source: APM Resources: Investigation Guide Noise: Low Performance: Fast Rule Type: Custom Query (KQL) ·

Share on:

This is an example of how to detect an unwanted web client user agent. This search matches the user agent for sqlmap 1.3.11, which is a popular FOSS tool for testing web applications for SQL injection vulnerabilities.

Web Application Suspicious Activity: Unauthorized Method

Sep 19, 2026 · Data Source: APM Resources: Investigation Guide Noise: High Performance: Normal Profile: Aggressive Rule Type: Custom Query (KQL) ·

Share on:

A request to a web application returned a 405 response, which indicates the web application declined to process the request because the HTTP method is not allowed for the resource.