HTTP double encoded URI - evasion or parser confusion
This rule detects multiple instances of HTTP double-encoded URIs from a single source within a 60-second window. Attackers often use double encoding to bypass security filters, WAFs, or input validation mechanisms that only perform a single decoding pass. This behavior is indicative of attempted exploitation, evasion, or directory traversal attacks.
Suricata
