SignalHunt
← All rules

RP-7003

high

Reverse Proxy Admin/Stats Interface Reachable

Detects a successful request to a reverse proxy or load balancer's own management/status endpoint (nginx stub_status, HAProxy stats page, Envoy admin interface). These expose backend pool membership, connection counts, and sometimes config - reconnaissance value for an attacker, and a sign the interface was left reachable from outside where only internal monitoring should ever reach it.

T1595.002T1190
Test this rule in the simulator

Detection logic

Fires as soon as one event matches: `uri` contains "/nginx_status" or "/haproxy?stats" or "/envoy/stats" or "/server-status" AND `status` is at least 200 AND `status` is less than 300.

{
  "detection_type": "selection",
  "selection": {
    "uri|contains": [
      "/nginx_status",
      "/haproxy?stats",
      "/envoy/stats",
      "/server-status"
    ],
    "status|gte": 200,
    "status|lt": 300
  }
}

Log source: category=reverse_proxy · Event ID(s): rp_access_log

Required log fields

  • client_ip
  • uri
  • status

Enabling this in your environment

Where: Reverse proxy configuration - restrict these endpoints to localhost/an internal monitoring CIDR (allow deny in nginx, or a separate internal-only listener), then log any request that still reaches them

nginx: location /nginx_status { allow 10.0.0.0/8; deny all; } - ensure the deny still gets logged rather than silently dropped.

This is a "should never happen" rule - any hit from outside the monitoring CIDR is itself the finding, not just a precursor to one.

False positives

  • Your own monitoring/scraping system (Prometheus node exporter, Datadog agent) polling the stats endpoint on a schedule - allowlist its source IP rather than disabling the rule

References