SignalHunt
← All rules

WAF-5003

high

Path Traversal / LFI Attempt Blocked

Detects a WAF block for a path traversal or local file inclusion pattern (e.g. "../../etc/passwd") in the request URI or parameters.

T1190T1083

Detection logic

{
  "detection_type": "selection",
  "selection": {
    "action": "block",
    "attack_type": "path_traversal"
  }
}

Log source: category=waf · Event ID(s): waf_block

Required log fields

  • src_ip
  • uri
  • matched_rule

Enabling this in your environment

Where: WAF - ensure the LFI/path-traversal managed rule group is enabled in blocking mode.

aws wafv2 update-web-acl --rules '[{"Name":"AWSManagedRulesLinuxRuleSet",...}]'

Pair with server-side path canonicalization/allow-listing - a WAF signature is one layer, not the only control.

False positives

  • Legitimate file-path-like parameters in specialized applications (file managers, CI tools) that weren't allow-listed

References