Unusual HTTP Request Method — Detection Rule
The following analytic detects Zeek HTTP requests using methods outside a configurable allowlist of standard and commonly used HTTP methods. Unusual methods can indicate protocol abuse, exploitation attempts, or command-and-control traffic. Review the method, source, destination, and URI to assess the activity.