ATT&CK T1070 - Possible Log File Access via Web

Darshan Thummar@Mighty

•updated Jun 10, 2026•0•0•3

This rule detects HTTP requests where the URI contains the string "/var/log/" (case-insensitive). This pattern is indicative of an attempt to access system log files directly via a web server, which could be part of an information gathering or defense evasion tactic.