Hello Evan,
Bare byte encoding is an IIS trick that uses non-ASCII chars as valid values in decoding
UTF-8 values. This is NOT in the HTTP standard, as all non-ASCII values have to be encoded
with a %. Bare byte encoding allows the user to emulate an IIS server and interpret
non-standard encodings correctly. The alert on this decoding should be enabled, because
there are no legitimate clients that encoded UTF-8 this way, since it is non-standard. In
summary, only IIS servers use this type of encoding, which is not an HTTP standard, and no
client connecting to the server should use this type of encoding.
If you want to leave the feature in place, but not see the large number of events, you can
disable the signature in question in your IPS policy and leave the functionality in place in the HTTP preprocessor for the Normalize UTF Encodings to UTF-8 option.
For now its priotity-3 which means it is not vulnerable.But you can suppress the events if you want. To check if its false positive or not we would need to check the captures for same.
Rate and mark correct if the post helps you
Regards
Jetsy
