Selecting suspicious activity using protocol data often requires analysis of which HTTP method?

Question

Options

• AGET
• BPOST
• CDELETE
• DAll of the above

• A
  14% (3)
• B
  24% (5)
• C
  5% (1)
• D
  57% (12)

Explanation

All three HTTP methods can carry indicators of suspicious activity, making "All of the above" the only complete answer. Relying on a single method would create blind spots in your monitoring and allow attackers to evade detection simply by choosing a different verb.

• GET alone is wrong - while GET requests can expose SQL injection attempts, directory traversal (../), or reconnaissance patterns in URL parameters, it isn't the only vector.
• POST alone is wrong - POST is a common channel for payload delivery, data exfiltration, and credential stuffing, but excluding other methods would miss significant threats.
• DELETE alone is wrong - DELETE requests can signal destructive attacks against REST APIs or unauthorized resource removal, but are far from the only concern.

Memory tip: Think of HTTP analysis as a full deck - threat hunters must watch every card (method), not just the aces. The phrase "No method is innocent" can remind you that all verbs (GET, POST, PUT, DELETE, OPTIONS, etc.) appear in real-world attack traffic and must be examined during protocol analysis.

No community discussion yet for this question.