Exclusive Lock on Security Tool Configuration File

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•2

This rule detects HTTP requests that contain both 'config' and 'lock' in the URI, suggesting an attempt to access or manipulate configuration files that might be locked, potentially indicating an exclusive lock on a security tool's configuration file. The rule is classified as 'trojan-activity'.