Potential Path Traversal Attempts on IIS

Ankit Mehta@Secvyn

•updated Jun 13, 2026•0•0•1

This rule detects potential path traversal attempts against an IIS web server by looking for sequences like '../' or '..\\' in the URI query string. It triggers an alert if five or more such attempts are observed from a single IP address within an hour, indicating a possible malicious scanning or exploitation attempt.