Detectionmediumtest

Path Traversal Exploitation Attempts

Detects path traversal exploitation attempts

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Subhash Popuri, Florian Roth (Nextron Systems), Thurein Oo, Nasreddine Bencherchali (Nextron Systems)Created Sat Sep 25Updated Thu Aug 317745c2ea-24a5-4290-b680-04359cb84b35web

Log Source

Web Server Log

CategoryWeb Server Log← raw: webserver

HTTP access logs from web servers capturing request paths, methods, and status codes.

Detection Logic

detection:
    selection:
        cs-uri-query|contains:
            - '../../../../../lib/password'
            - '../../../../windows/'
            - '../../../etc/'
            - '..%252f..%252f..%252fetc%252f'
            - '..%c0%af..%c0%af..%c0%afetc%c0%af'
            - '%252e%252e%252fetc%252f'
    condition: selection