HighALERT-4205engine: heuristic

Directory Traversal Against Web Server

analyst review

Raw alert — normalized QRadar offense

asset: vpn-gw-01
protocol: HTTP :80
src_ip: 156.240.2.115
dest_ip: 10.20.1.2
magnitude: 7/10
severity: 6/10
credibility: 6/10
relevance: 8/10
src network: external
events / flows: 214 / 158

triggered rules

▹ Web: SQL Injection Signature Match
▹ Web: Malicious Request Pattern

full offense JSON

{
  "offense_id": 4205,
  "description": "Directory Traversal Against Web Server :: Web Attack targeting vpn-gw-01",
  "offense_type": "Source IP",
  "offense_source": "156.240.2.115",
  "magnitude": 7,
  "severity": 6,
  "credibility": 6,
  "relevance": 8,
  "status": "OPEN",
  "source_network": "external",
  "destination_networks": [
    "internal_corp"
  ],
  "event_count": 214,
  "flow_count": 158,
  "start_time": "2025-11-03T03:04:00+00:00",
  "last_updated_time": "2025-11-03T04:33:00+00:00",
  "categories": [
    "Exploit",
    "Web Application Attack"
  ],
  "rules": [
    "Web: SQL Injection Signature Match",
    "Web: Malicious Request Pattern"
  ],
  "assigned_to": null,
  "dest_port": 80
}

AI triage

Likely web attack: Directory Traversal Against Web Server from external source 156.240.2.115 against vpn-gw-01 (10.20.1.2) over HTTP, 214 events observed.

MITRE ATT&CK

T1190Exploit Public-Facing ApplicationInitial Accessconfidence 95%

Alert indicators (Directory Traversal Against Web Server; rules: Web: SQL Injection Signature Match) overlap most strongly with T1190 Exploit Public-Facing Application among the ATT&CK shortlist.

Priority — High

Scored High based on: QRadar magnitude 7/10; source is external to the network.

Recommended next steps

1.Review the raw request payload and confirm whether the application was actually vulnerable.
2.Check WAF/application logs for a successful response (200 with data) vs. blocked.
3.Validate input handling on the targeted endpoint; block the source IP.
4.Scan the web asset for web shells or unexpected file changes.

Suggested hunting query (KQL)

AppServiceHTTPLogs
| where TimeGenerated > ago(24h)
| where CIp == "156.240.2.115"
| project TimeGenerated, CsMethod, CsUriStem, ScStatus, CsUriQuery

ATT&CK candidate shortlist — matched before the model was called, so it justifies from real technique IDs

T1190Exploit Public-Facing Application·12T1505Server Software Component·5.5T1059Command and Scripting Interpreter·5T1546.012Image File Execution Options Injection·4.5T1583.006Web Services·4.5T1659Content Injection·4.5T1036.005Match Legitimate Resource Name or Location·3.5