SignalHunt
← All rules

WAF-5002

medium

Cross-Site Scripting Attempt Blocked

Detects a WAF signature match and block for a cross-site scripting (XSS) pattern in a request parameter, header, or body.

T1190T1059.007

Detection logic

{
  "detection_type": "selection",
  "selection": {
    "action": "block",
    "attack_type": "xss"
  }
}

Log source: category=waf · Event ID(s): waf_block

Required log fields

  • src_ip
  • uri
  • matched_rule

Enabling this in your environment

Where: WAF - ensure the XSS managed rule group is enabled in blocking mode.

aws wafv2 update-web-acl --rules '[{"Name":"AWSManagedRulesCommonRuleSet",...}]'

Tune this against known legitimate rich-text/HTML-accepting endpoints before enabling block mode broadly, or expect false positives there.

False positives

  • Content-heavy legitimate requests (e.g. a CMS admin pasting HTML/rich text) can trip generic XSS signatures

References