Webserver Path Traversal Exploitation Attempts via Suspicious URI Query Encodings

Alerts on web requests with URL query path traversal patterns targeting /etc/ and other sensitive filesystem paths.

FreeUnreviewedSigmamediumv1

webserver-path-traversal-exploitation-attempts-via-suspicious-uri-query-encoding-7745c2ea

title: Webserver Path Traversal Exploitation Attempts via Suspicious URI Query Encodings
id: fea95278-f728-441b-865a-961c0469da31
status: test
description: This rule flags web requests where the URL query contains clear path traversal payloads targeting sensitive paths such as /etc/, Windows directories, and a password-related file segment. Attackers use traversal strings to escape intended web directories and read unintended filesystem resources. Detection relies on webserver request telemetry, specifically the contents of the cs-uri-query field, including multiple URL-encoded and double-encoded traversal patterns.
references:
  - https://github.com/projectdiscovery/nuclei-templates
  - https://book.hacktricks.xyz/pentesting-web/file-inclusion
  - https://github.com/SigmaHQ/sigma/blob/master/rules/web/webserver_generic/web_path_traversal_exploitation_attempt.yml
author: Subhash Popuri (@pbssubhash), Florian Roth (Nextron Systems), Thurein Oo, Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2021-09-25
modified: 2023-08-31
tags:
  - attack.initial-access
  - attack.t1190
logsource:
  category: webserver
detection:
  selection:
    cs-uri-query|contains:
      - ../../../../../lib/password
      - ../../../../windows/
      - ../../../etc/
      - ..%252f..%252f..%252fetc%252f
      - ..%c0%af..%c0%af..%c0%afetc%c0%af
      - "%252e%252e%252fetc%252f"
  condition: selection
falsepositives:
  - Expected to be continuously seen on systems exposed to the Internet
  - Internal vulnerability scanners
level: medium
license: DRL-1.1
related:
  - id: 7745c2ea-24a5-4290-b680-04359cb84b35
    type: derived

What it detects

This rule flags web requests where the URL query contains clear path traversal payloads targeting sensitive paths such as /etc/, Windows directories, and a password-related file segment. Attackers use traversal strings to escape intended web directories and read unintended filesystem resources. Detection relies on webserver request telemetry, specifically the contents of the cs-uri-query field, including multiple URL-encoded and double-encoded traversal patterns.

Known false positives

Expected to be continuously seen on systems exposed to the Internet
Internal vulnerability scanners

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.