Falco low stable other

Directory traversal monitored file read

Web applications can be vulnerable to directory traversal attacks that allow accessing files outside of the web app's root directory (e.g. Arbitrary File Read bugs). System directories like /etc are typically accessed via absolute paths. Access patterns outside of this (here path traversal) can be regarded as suspicious. This rule includes failed file open attempts.

View Source

Detection Logic

(open_read or open_file_failed) and (etc_dir or user_ssh_directory or
     fd.name startswith /root/.ssh or
     fd.name contains "id_rsa")
and directory_traversal and not proc.pname in (shell_binaries)

Field Validations

Loading…

Comments (0)

Loading comments...