ATT&CK T1190 - Path Traversal Attempt

Darshan Thummar@Mighty

•updated Jun 10, 2026•0•0•1

This rule detects attempts at path traversal vulnerabilities by looking for the string "../../../" in HTTP URIs. This pattern is commonly used by attackers to navigate directory structures outside of the intended web root.