Sensitive path
Flags HTTP requests to sensitive files or administrative endpoints — secrets and VCS/config files (.env, .git, .aws, .ssh, config.php), admin panels…
What it detects
Flags HTTP requests to sensitive files or administrative endpoints — secrets and VCS/config files (.env, .git, .aws, .ssh, config.php), admin panels (wp-login, phpMyAdmin, /administrator), and infra/debug endpoints (/actuator, /server-status, /vendor/phpunit). Matches the parsed request path (url_path), so it distinguishes probing of sensitive locations from ordinary traffic regardless of the response code.
MITRE ATT&CK mapping
False positives and triage
Some of these paths are hit by legitimate admins and monitoring. Confidence rises with an external/unknown source IP, many distinct sensitive paths from one client (scanning), or a successful (2xx) response to a secrets file. Baseline the admin endpoints your team actually uses.
The rule
Declarative YAML read by the detection engine — data, never executed. Confidence 55%. Source: rules/web/sensitive_path_access.yaml, licensed under the Apache License 2.0.
id: web.access.sensitive_path
version: 1.1.0
status: experimental
severity: medium
confidence: 0.55
platforms: [windows, linux, macos]
mitre_techniques: [T1083, T1595.003]
description: |
Flags HTTP requests to sensitive files or administrative endpoints — secrets and
VCS/config files (.env, .git, .aws, .ssh, config.php), admin panels (wp-login,
phpMyAdmin, /administrator), and infra/debug endpoints (/actuator, /server-status,
/vendor/phpunit). Matches the parsed request path (`url_path`), so it distinguishes
probing of sensitive locations from ordinary traffic regardless of the response code.
match:
event_action: http_request
url_path_contains_any:
- "/.env"
- "/.git/"
- "/.aws/"
- "/.ssh/"
- "/.svn/"
- "/config.php"
- "/wp-login.php"
- "/wp-admin"
- "/administrator"
- "/phpmyadmin"
- "/actuator"
- "/server-status"
- "/vendor/phpunit"
- "/.well-known/security"
correlation_keys: [hostname]
false_positive_guidance: |
Some of these paths are hit by legitimate admins and monitoring. Confidence rises with an
external/unknown source IP, many distinct sensitive paths from one client (scanning), or a
successful (2xx) response to a secrets file. Baseline the admin endpoints your team actually uses.
Related detections
Run this rule on your own logs — offline
KIROSEC runs this rule and the rest of the library over Windows, Linux, macOS and cloud audit logs on the analyst's own machine. Every alert links to the events that raised it, and nothing leaves the device.