This anomaly rule detects Zeek HTTP requests that use methods outside a configured allowlist of standard and commonly used HTTP verbs. It queries Zeek HTTP logs (zeek_http) for any method value and filters out methods in the allowed set (e.g., GET, POST, PUT, DELETE, OPTIONS, TRACE, etc.). Unusual methods can indicate protocol abuse, exploitation attempts, or command-and-control (C2) traffic. The search normalizes destination port, destination, and source, then aggregates results by src, dest, and dest_port, capturing the observed method(s), URI, and status code along with the first and last seen times. It emits an intermediate finding noting an unusual HTTP method from a particular source to a destination/port, including the URI, and surfaces the URI as a threat object for further investigation. The analytic story labels suggest potential Command and Control and HTTP-related anomalies (e.g., HTTP Request Smuggling). The rule ties to MITRE ATT&CK techniques T1071.001 (Web Protocols) and T1190, and is applicable to Web Server assets monitored by Splunk (Splunk Enterprise, Splunk ES, Splunk Cloud). Implementation relies on ingesting Zeek HTTP logs with the latest Splunk Add-on for Zeek and configuring the zeek_http macro to align with the Sourcetype used. Analysts should review the method, source, destination, and URI when a match is found, as some legitimate applications may use non-standard methods; update the allowlist as needed to reduce false positives.