SOC169 EventID:119 — Possible IDOR Attack Detected — letsdefend.io

SOC169 EventID:119 — Possible IDOR Attack Detected — letsdefend.io

Let’s take a look at the provided alert report before starting our analysis.

EventID                :119
Event Time             :Feb, 28, 2022, 10:48 PM
Rule                   :SOC169 - Possible IDOR Attack Detected
Level                  :Security Analyst
Hostname               :WebServer1005
Destination IP Address :172.16.17.15
Source IP Address      :134.209.118.137
HTTP Request Method    :POST
Requested URL          :https://172.16.17.15/get_user_info/
User-Agent             :Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 1.1.4322)
Alert Trigger Reason   :consecutive requests to the same page
Device Action …

blue team letsdefendio soc