heroui logo

Path Traversal Exploitation Attempts

Sigma Rules

View Source
Summary
The rule 'Path Traversal Exploitation Attempts' is designed to detect instances of path traversal attacks that aim to exploit vulnerabilities in web server configurations. Path traversal attacks occur when an attacker uses directory traversal sequences (e.g., '../../') to gain unauthorized access to server files that are outside the web root directory. This rule specifically looks for attempts to access sensitive directories, such as those containing passwords or configuration files, by inspecting the 'cs-uri-query' part of the web requests. The detection logic uses a selection of known patterns and encoded sequences commonly associated with path traversal attempts, such as multiple directory traversals and patterns targeting specific paths like '/etc/' and '/windows/'. With its medium severity level, this rule helps mitigate risks posed by potential exploitation of vulnerable file inclusion mechanisms in web applications hosted on a server.
Categories
  • Web
Data Sources
  • Web Credential
  • Network Traffic
Created: 2021-09-25