SOC170 EventID:120 — Passwd Found in Requested URL — Possible LFI Attack — letsdefend.io

SOC170 EventID:120 — Passwd Found in Requested URL — Possible LFI Attack — letsdefend.io

Let’s have a look at the provided alert report below.

 
EventID : 120
Event Time             :Mar, 01, 2022, 10:10 AM
Rule                   :SOC170 - Passwd Found in Requested URL - Possible LFI Attack
Level                  :Security Analyst
Hostname               :WebServer1006
Destination IP Address :172.16.17.13
Source IP Address      :106.55.45.162
HTTP Request Method    :GET
Requested URL          :https://172.16.17.13/?file=../../../../etc/passwd
User-Agent             :Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 1.1.4322)
Alert Trigger Reason …

blue team letsdefendio soc