HTTP requests containing path traversal sequences

Classification:

attack

Tactic:

Technique:

このページは日本語には対応しておりません。随時翻訳に取り組んでいます。
翻訳に関してご質問やご意見ございましたら、お気軽にご連絡ください。

Goal

Detect HTTP requests containing path traversal sequences in the URL path or query string, including when the response is successful.

This rule monitors OCSF HTTP requests for encoded and plain parent-directory traversal patterns, grouped by @ocsf.src_endpoint.ip.

Review whether traversal attempts reached sensitive files or APIs and whether responses leaked content.
If activity is malicious and unauthorized, consider blocking or rate limiting {{@ocsf.src_endpoint.ip}} and follow your incident response process.