Potential File Inclusion Attempt via Web Server Logs

Ankit Mehta@Secvyn

•updated Jun 13, 2026•0•0•1

This rule detects potential file inclusion attempts by monitoring IIS web server logs for URI queries containing keywords like 'file=', 'path=', or 'input='. It then aggregates these attempts by client IP address over one-hour intervals and alerts if 10 or more such attempts are observed from a single IP within that timeframe, indicating a possible attack.