SignalHunt
← All rules

WEB-6003

low

Sensitive Admin Path Accessed Successfully

Detects a successful (HTTP 200) request to a well-known administrative interface path (WordPress admin, phpMyAdmin, generic /administrator). On its own this can be entirely legitimate traffic to a real admin panel - the value is as a building block for correlation (e.g. paired with WAF-5005's login-then-attack pattern) and as a baseline of "who actually reaches these paths" for an environment that shouldn't expose them publicly at all.

T1190

Detection logic

{
  "detection_type": "selection",
  "selection": {
    "uri|contains": [
      "/wp-admin",
      "/administrator",
      "/phpmyadmin"
    ],
    "status": 200
  }
}

Log source: category=web_server · Event ID(s): access_log

Required log fields

  • client_ip
  • uri
  • status

Enabling this in your environment

Where: Web server access log configuration - status code and URI are standard fields in default log formats.

# no special config needed beyond default access logging

Consider whether these paths should be reachable from the public internet at all - restricting by IP allow-list or VPN is a stronger control than detecting access after the fact.

False positives

  • The application's actual, legitimate administrators using the panel normally - this is expected, not incidental

References