SignalHunt
← All rules

WEBPROXY-9001

critical

Access to a Known-Malware Category URL Was Allowed

Detects a request to a URL the proxy's own category database has classified as malware/C2 that was nonetheless allowed through, rather than blocked - a category-policy gap letting a known-bad destination reach the endpoint.

T1071.001

Detection logic

{
  "detection_type": "selection",
  "selection": {
    "action": "allowed",
    "category": "malware"
  }
}

Log source: category=web_proxy · Event ID(s): proxy_request

Required log fields

  • action
  • category
  • domain
  • user

Enabling this in your environment

Where: Web proxy category-policy action mapping

Confirm the "malware" and "command-and-control" URL categories are mapped to Block (not Allow or Warn) in the proxy's policy (Zscaler URL Filtering, Forcepoint, Blue Coat/Symantec ProxySG, Squid + a category feed), and that the request is still logged even when allowed by an exception rule.

A single hit here usually means either a policy exception was misconfigured, or the category feed only updated after the endpoint already connected - both are worth knowing.

False positives

  • A stale/incorrect category-database entry mislabeling a benign domain (common right after a threat-feed update, rare afterward)
  • A security team's own sandboxing/detonation host deliberately allowed to reach malware categories for analysis

References