Sigma medium test sigma

Path Traversal Exploitation Attempts

Detects path traversal exploitation attempts

View Source

Detection Logic

{
  "selection": {
    "cs-uri-query
| contains": [
      "../../../../../lib/password",
      "../../../../windows/",
      "../../../etc/",
      "..%252f..%252f..%252fetc%252f",
      "..%c0%af..%c0%af..%c0%afetc%c0%af",
      "%252e%252e%252fetc%252f"
    ]
  },
  "condition": "selection"
}

False Positives

  • ⚠ Expected to be continuously seen on systems exposed to the Internet
  • ⚠ Internal vulnerability scanners

Field Validations

Loading…

Comments (0)

Loading comments...