Skip to content
skopnix
Section E · Detections
← All detectionsATT&CK technique

T1190

210 rules70 findings

T1190 on attack.mitre.org ↗

  1. CVE exploitation

    CVE-2016-3081 exploitation attempt

    Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

    CVE-2016-3081

    T1190conf 90SIGAQLXQL

  2. CVE exploitation

    CVE-2023-46805 exploitation attempt

    Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

    CVE-2023-46805 · GhostEmperor · UNC5337 · UTA0178 · WARP PANDA

    T1190conf 90SIGAQLXQL

  3. CVE exploitation

    CVE-2024-21887 exploitation attempt

    Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

    CVE-2024-21887 · UNC5325 · UNC5330 · UNC5337 · UTA0178 · WARP PANDA

    T1190conf 90SIGAQLXQL

  4. CVE exploitation

    CVE-2025-61882 exploitation attempt

    Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

    CVE-2025-61882

    T1190conf 90SIGAQLXQL

  5. CVE exploitation

    CVE-2026-34908 exploitation attempt

    Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

    CVE-2026-34908

    T1190conf 90SIGAQLXQL

  6. CVE exploitation

    CVE-2026-34910 exploitation attempt

    Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

    CVE-2026-34910

    T1190conf 90SIGAQLXQL

  7. CVE exploitation

    CVE-2002-1131 exploitation attempt

    Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

    CVE-2002-1131

    T1190conf 70SIGAQLXQL

  8. CVE exploitation

    CVE-2006-2842 exploitation attempt

    Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

    CVE-2006-2842

    T1190conf 70SIGAQLXQL

  9. CVE exploitation

    CVE-2007-4504 exploitation attempt

    Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

    CVE-2007-4504

    T1190conf 70SIGAQLXQL

  10. CVE exploitation

    CVE-2008-1059 exploitation attempt

    Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

    CVE-2008-1059

    T1190conf 70SIGAQLXQL

  11. CVE exploitation

    CVE-2008-2650 exploitation attempt

    Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

    CVE-2008-2650

    T1190conf 70SIGAQLXQL

  12. CVE exploitation

    CVE-2008-4668 exploitation attempt

    Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

    CVE-2008-4668

    T1190conf 70SIGAQLXQL

  13. CVE exploitation

    CVE-2008-5587 exploitation attempt

    Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

    CVE-2008-5587

    T1190conf 70SIGAQLXQL

  14. CVE exploitation

    CVE-2008-6080 exploitation attempt

    Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

    CVE-2008-6080

    T1190conf 70SIGAQLXQL

  15. CVE exploitation

    CVE-2008-6172 exploitation attempt

    Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

    CVE-2008-6172

    T1190conf 70SIGAQLXQL

  16. CVE exploitation

    CVE-2008-6222 exploitation attempt

    Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

    CVE-2008-6222

    T1190conf 70SIGAQLXQL

  17. CVE exploitation

    CVE-2008-6668 exploitation attempt

    Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

    CVE-2008-6668

    T1190conf 70SIGAQLXQL

  18. CVE exploitation

    CVE-2009-0545 exploitation attempt

    Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

    CVE-2009-0545

    T1190conf 70SIGAQLXQL

  19. CVE exploitation

    CVE-2009-0932 exploitation attempt

    Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

    CVE-2009-0932

    T1190conf 70SIGAQLXQL

  20. CVE exploitation

    CVE-2009-1496 exploitation attempt

    Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

    CVE-2009-1496

    T1190conf 70SIGAQLXQL

  21. CVE exploitation

    CVE-2009-1872 exploitation attempt

    Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

    CVE-2009-1872

    T1190conf 70SIGAQLXQL

  22. CVE exploitation

    CVE-2009-2015 exploitation attempt

    Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

    CVE-2009-2015

    T1190conf 70SIGAQLXQL

  23. CVE exploitation

    CVE-2009-2100 exploitation attempt

    Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

    CVE-2009-2100

    T1190conf 70SIGAQLXQL

  24. CVE exploitation

    CVE-2009-3053 exploitation attempt

    Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

    CVE-2009-3053

    T1190conf 70SIGAQLXQL

  25. CVE exploitation

    CVE-2009-3318 exploitation attempt

    Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

    CVE-2009-3318

    T1190conf 70SIGAQLXQL

  26. CVE exploitation

    CVE-2009-4202 exploitation attempt

    Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

    CVE-2009-4202

    T1190conf 70SIGAQLXQL

  27. CVE exploitation

    CVE-2009-4679 exploitation attempt

    Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

    CVE-2009-4679

    T1190conf 70SIGAQLXQL

  28. CVE exploitation

    CVE-2009-5114 exploitation attempt

    Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

    CVE-2009-5114

    T1190conf 70SIGAQLXQL

  29. CVE exploitation

    CVE-2010-0157 exploitation attempt

    Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

    CVE-2010-0157

    T1190conf 70SIGAQLXQL

  30. CVE exploitation

    CVE-2010-0467 exploitation attempt

    Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

    CVE-2010-0467

    T1190conf 70SIGAQLXQL

  31. CVE exploitation

    CVE-2010-0696 exploitation attempt

    Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

    CVE-2010-0696

    T1190conf 70SIGAQLXQL

  32. CVE exploitation

    CVE-2010-0942 exploitation attempt

    Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

    CVE-2010-0942

    T1190conf 70SIGAQLXQL

  33. CVE exploitation

    CVE-2010-0943 exploitation attempt

    Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

    CVE-2010-0943

    T1190conf 70SIGAQLXQL

  34. CVE exploitation

    CVE-2010-0944 exploitation attempt

    Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

    CVE-2010-0944

    T1190conf 70SIGAQLXQL

  35. CVE exploitation

    CVE-2010-0972 exploitation attempt

    Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

    CVE-2010-0972

    T1190conf 70SIGAQLXQL

  36. CVE exploitation

    CVE-2010-0982 exploitation attempt

    Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

    CVE-2010-0982

    T1190conf 70SIGAQLXQL

  37. CVE exploitation

    CVE-2010-0985 exploitation attempt

    Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

    CVE-2010-0985

    T1190conf 70SIGAQLXQL

  38. CVE exploitation

    CVE-2010-1056 exploitation attempt

    Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

    CVE-2010-1056

    T1190conf 70SIGAQLXQL

  39. CVE exploitation

    CVE-2010-1081 exploitation attempt

    Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

    CVE-2010-1081

    T1190conf 70SIGAQLXQL

  40. CVE exploitation

    CVE-2010-1217 exploitation attempt

    Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

    CVE-2010-1217

    T1190conf 70SIGAQLXQL

  41. CVE exploitation

    CVE-2010-1219 exploitation attempt

    Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

    CVE-2010-1219

    T1190conf 70SIGAQLXQL

  42. CVE exploitation

    CVE-2010-1302 exploitation attempt

    Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

    CVE-2010-1302

    T1190conf 70SIGAQLXQL

  43. CVE exploitation

    CVE-2010-1304 exploitation attempt

    Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

    CVE-2010-1304

    T1190conf 70SIGAQLXQL

  44. CVE exploitation

    CVE-2010-1305 exploitation attempt

    Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

    CVE-2010-1305

    T1190conf 70SIGAQLXQL

  45. CVE exploitation

    CVE-2010-1306 exploitation attempt

    Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

    CVE-2010-1306

    T1190conf 70SIGAQLXQL

  46. CVE exploitation

    CVE-2010-1307 exploitation attempt

    Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

    CVE-2010-1307

    T1190conf 70SIGAQLXQL

  47. CVE exploitation

    CVE-2010-1308 exploitation attempt

    Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

    CVE-2010-1308

    T1190conf 70SIGAQLXQL

  48. CVE exploitation

    CVE-2010-1312 exploitation attempt

    Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

    CVE-2010-1312

    T1190conf 70SIGAQLXQL

  49. CVE exploitation

    CVE-2010-1313 exploitation attempt

    Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

    CVE-2010-1313

    T1190conf 70SIGAQLXQL

  50. CVE exploitation

    CVE-2010-1314 exploitation attempt

    Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

    CVE-2010-1314

    T1190conf 70SIGAQLXQL

  51. CVE exploitation

    CVE-2010-1315 exploitation attempt

    Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

    CVE-2010-1315

    T1190conf 70SIGAQLXQL

  52. CVE exploitation

    CVE-2010-1340 exploitation attempt

    Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

    CVE-2010-1340

    T1190conf 70SIGAQLXQL

  53. CVE exploitation

    CVE-2010-1345 exploitation attempt

    Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

    CVE-2010-1345

    T1190conf 70SIGAQLXQL

  54. CVE exploitation

    CVE-2010-1352 exploitation attempt

    Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

    CVE-2010-1352

    T1190conf 70SIGAQLXQL

  55. CVE exploitation

    CVE-2010-1353 exploitation attempt

    Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

    CVE-2010-1353

    T1190conf 70SIGAQLXQL

  56. CVE exploitation

    CVE-2010-1354 exploitation attempt

    Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

    CVE-2010-1354

    T1190conf 70SIGAQLXQL

  57. CVE exploitation

    CVE-2018-13379 exploitation attempt

    Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

    CVE-2018-13379 · APT29 · APT35 · DEV-0270 · ENERGETIC BEAR · Fox Kitten · lockbit · 3 more

    T1190conf 70SIGAQLXQL

  58. CVE exploitation

    CVE-2019-11510 exploitation attempt

    Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

    CVE-2019-11510 · APT29 · ENERGETIC BEAR · Fox Kitten · OilRig · Turla

    T1190conf 70SIGAQLXQL

  59. CVE exploitation

    CVE-2019-19781 exploitation attempt

    Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

    CVE-2019-19781 · APT29 · APT41 · Fox Kitten

    T1190conf 70SIGAQLXQL

  60. CVE exploitation

    CVE-2020-14750 exploitation attempt

    Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

    CVE-2020-14750 · Prophet Spider

    T1190conf 70SIGAQLXQL

  61. CVE exploitation

    CVE-2020-14882 exploitation attempt

    Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

    CVE-2020-14882 · Prophet Spider

    T1190conf 70SIGAQLXQL

  62. CVE exploitation

    CVE-2020-5902 exploitation attempt

    Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

    CVE-2020-5902 · BackdoorDiplomacy · Fox Kitten

    T1190conf 70SIGAQLXQL

  63. CVE exploitation

    CVE-2021-34473 exploitation attempt

    Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

    CVE-2021-34473 · APT35 · blackbyte · BRONZE STARLIGHT · Witchetty

    T1190conf 70SIGAQLXQL

  64. CVE exploitation

    CVE-2021-35464 exploitation attempt

    Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

    CVE-2021-35464 · Scattered Spider

    T1190conf 70SIGAQLXQL

  65. CVE exploitation

    CVE-2021-44228 exploitation attempt

    Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

    CVE-2021-44228 · APT35 · APT41 · BRONZE STARLIGHT · Sea Turtle · Water Sigbin

    T1190conf 70SIGAQLXQL

  66. CVE exploitation

    CVE-2022-44877 exploitation attempt

    Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

    CVE-2022-44877 · CRYSTALRAY

    T1190conf 70SIGAQLXQL

  67. CVE exploitation

    CVE-2023-22515 exploitation attempt

    Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

    CVE-2023-22515 · Storm-0062 · Ukrainian Cyber Alliance

    T1190conf 70SIGAQLXQL

  68. CVE exploitation

    CVE-2023-47246 exploitation attempt

    Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

    CVE-2023-47246 · DEV-0950

    T1190conf 70SIGAQLXQL

  69. CVE exploitation

    CVE-2026-12227 exploitation attempt

    Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

    CVE-2026-12227

    T1190conf 70SIGAQLXQL

  70. CVE exploitation

    CVE-2026-54617 exploitation attempt

    Keys on the distinctive part of the exploit request only (path traversal, exploit syntax in the query, an unusual parameter) — never on an endpoint the product serves in normal use. Needs raw request-URI logging (some web servers normalise ../ away). Scanners hitting the internet produce true-positive ATTEMPTS: correlate with sc-status / response size before declaring compromise.

    CVE-2026-54617

    T1190conf 70SIGAQLXQL

How to deploy

SIGSigma

  1. 1.Convert for your SIEM with sigma-cli / pySigma, e.g. sigma convert -t splunk -p sysmon rule.yml.
  2. 2.Run it as a hunt first: every rule ships as status experimental.
  3. 3.Promote to an alert once a week of results is clean on your data.

Check · The processing pipeline must map the logsource (firewall, dns, proxy, webserver, process_creation) to your field names.

AQLIBM QRadar

  1. 1.Create the reference set from its spec (Reference Data API, or Admin > Reference Set Management) and schedule the skopnix feed load.
  2. 2.Paste the AQL into Log Activity > Advanced Search to hunt the last seven days.
  3. 3.For alerting, build the CRE rule from the test stack shown and exclude your known-good building block.

Check · Custom properties ("URL Host", "URL", "File Hash", "Process CommandLine") come from your DSMs and content extensions; rename them if yours differ.

XQLCortex XDR

  1. 1.Paste the XQL into Incident Response > Investigation > Query Builder > XQL Search.
  2. 2.To alert, save it as a Correlation Rule and set the MITRE tactic and technique printed with the rule.
  3. 3.Schedule it on the interval you hunt at; keep the fields stage for the alert's columns.

Check · CVE rules read PAN-OS URL logs (panw_ngfw_url_raw), which need the NGFW integration and, for HTTPS, decryption.