Signature Detail

HTTP: IIS Single Encoding (2)

This signature detects a single digit encoded in a URL. Microsoft Internet Information Services (IIS) uses special techniques to decode URLs. Attackers can be attempting to exploit these IIS techniques to evade detection by IDP.

Extended Description

An HTTP request in which the Unicode-encoded forms of the "/" or "\" delimiter characters exist in a requested URL constitutes a protocol anomaly. The condition could be the result of a software error, or it could indicate malicious activity involving intentional transmission of Unicode-encoded delimiter strings is underway.

References

• URL: http://www.idsresearch.org/http_evasions.html