Possible path traversal via HTTP request

Cortex XDR Analytics Alert Reference by data source

Product

Cortex XDR

Last date published

2024-12-03

Activation Period	14 Days
Training Period	30 Days
Test Period	N/A (single event)
Deduplication Period	2 Days
Required Data	Requires one of the following data sources: Palo Alto Networks Platform Logs OR XDR Agent
Detection Modules
Detector Tags
ATT&CK Tactic	Discovery (TA0007)
ATT&CK Technique	File and Directory Discovery (T1083)
Severity	Low

The endpoint received a suspicious URI via an HTTP request that resembles a path traversal attempt.

Attackers may exploit server components or misconfigurations to access arbitrary sensitive files on the web server.

Inspect the legitimacy of the URI path.
Ensure that the rare URI is not a legitimate result of routine development actions on the web server.

ATT&CK Tactic	Discovery (TA0007)
ATT&CK Technique	File and Directory Discovery (T1083)
Severity	Medium

The endpoint received a suspicious URI via an HTTP request that resembles a path traversal attempt.

Attackers may exploit server components or misconfigurations to access arbitrary sensitive files on the web server.

Inspect the legitimacy of the URI path.
Ensure that the rare URI is not a legitimate result of routine development actions on the web server.

ATT&CK Tactic	Discovery (TA0007)
ATT&CK Technique	File and Directory Discovery (T1083)
Severity	Medium

The endpoint received a suspicious URI via an HTTP request that resembles a path traversal attempt.

Attackers may exploit server components or misconfigurations to access arbitrary sensitive files on the web server.

Inspect the legitimacy of the URI path.
Ensure that the rare URI is not a legitimate result of routine development actions on the web server.

ATT&CK Tactic	Discovery (TA0007)
ATT&CK Technique	File and Directory Discovery (T1083)
Severity	Medium

The endpoint received a suspicious URI via an HTTP request that resembles a path traversal attempt.

Attackers may exploit server components or misconfigurations to access arbitrary sensitive files on the web server.

Inspect the legitimacy of the URI path.
Ensure that the rare URI is not a legitimate result of routine development actions on the web server.