SOC170 — Passwd Found in Requested URL — Possible LFI Attack

SOC170 — Passwd Found in Requested URL — Possible LFI Attack

Event ID: 120
Platform: LetsDefend

Alert

Based on the information provided in this alert, on the host WebServer1006 with IP 172[.]16[.]17[.]13, a URL containing a Local File Inclusion (LFI) payload was requested, triggering this alert. LFI is a Web Attack that can expose sensitive data, execute code on the web server, and execute code on the client side. No action was taken on this alert …

blue team cybersecurity incident response letsdefendio lfi vulnerability