312-39V2: Certified SOC Analyst v2

By ECCouncil · Question Mode

QuestionQ109

VerifiedUnderstanding Cyber Threats, IoCs, and Attack Methodology

John, a SOC analyst, identified an event-log entry matching the following regex while monitoring and analyzing Apache web-server logs:

/(\.|(%|%2S)2E)(\.|(%|%2S)2E)(V|(%|%2S)2F|\\|(%|%2S)SC)/i

What does this event-log entry indicate?

Explanation

Directory traversal attacks use parent-directory sequences such as ../ or ..\, often URL-encoded, to try to reach files and directories outside the web application's permitted path. The regex matches these traversal patterns and encoded variants.

Community Discussion

No comments yet. Be the first to start the discussion!