CSA (312-39) SOC Simulation Lab
Analyze real-world SIEM detection logic. You will learn to decode regular expressions used in Web Application Firewalls (WAFs) and SIEM correlation rules to identify evasion techniques.
Scenario Context
You are a Tier 3 SOC Analyst reviewing escalations from the overnight shift. The SIEM triggered an alert titled Web_Suspicious_URI_Pattern_Match on your external-facing Apache web servers hosting a customer portal.
The L1 analyst noted that the source IP has been making multiple requests to an API endpoint designed to download PDF invoices, but the WAF did not block the traffic. The traffic hit a custom regex rule implemented directly on the SIEM for threat hunting.
Security Environment
SIEM Search Query:
Raw Apache Access Log Snippet:
Question
John, a SOC analyst, while monitoring and analyzing Apache web server logs, identified an event log matching Regex /(\.|(%|%25)2E)(\.|(%|%25)2E)(\/|(%|%25)2F|\\|(%|%25)5C)/i.
What does this event log indicate?
%2E is the URL encoding for a dot (.), and %2F is the encoding for a forward slash (/). What does dot-dot-slash represent in file systems?
Expert Insight
What is happening
An attacker is attempting to escape the intended web document root directory by using a technique known as Directory Traversal (or Path Traversal). Because standard signatures easily catch ../ payloads, the attacker is using URL encoding (%2e%2e%2f) and Double URL encoding (%252e%252e%252f) to bypass poorly configured WAFs that only decode the payload once before inspecting it.
Why Option C is Correct
The regex provided is designed specifically to detect evasion techniques for Directory Traversal. Let's break down the logic:
1. (\.|(%|%25)2E) matches a dot ., its URL encoded form %2E, or its double encoded form %252E.
2. This block repeats twice, looking for two consecutive dots (..).
3. (\/|(%|%25)2F|\\|(%|%25)5C) matches a forward slash /, backslash \, or their URL/double-URL encoded equivalents.
Combined, this explicitly hunts for variations of ../ or ..\, which are the fundamental characters used in Directory Traversal attacks.
Why Other Options are Wrong
A. XSS Attack: Cross-Site Scripting focuses on injecting executable client-side scripts (like <script>, %3Cscript%3E). This regex does not look for tags or script keywords.
B. SQL injection Attack: SQLi manipulates database queries using characters like single quotes (' or %27), semicolons, and boolean operators (OR 1=1).
D. Parameter Tampering: While the attacker *is* manipulating a parameter, Parameter Tampering generally refers to changing business logic values (e.g., changing price=100 to price=1), not attempting to access local OS files via path manipulation.
Real-World SOC Application
In a modern SOC, relying on simple string matches like `*../*` is ineffective. Attackers know WAFs decode traffic, but they exploit architectural flaws where a WAF decodes once, finds no malicious strings, and passes it to the backend. The backend web server (like Apache or Tomcat) might decode it a *second* time when processing the URI, triggering the attack. As an analyst, writing and analyzing regex that accounts for encoding permutations is a daily necessity for creating high-fidelity Splunk/Sentinel alerts.
MINI LESSON: Double Encoding Evasion
How does Double URL Encoding work?
- Normal:
. - URL Encoded: The ASCII hex value of a dot is 2E. We prepend
%to get%2e. - Double Encoded: We take the
%character from%2eand URL encode *it*. The hex value of%is 25. Therefore,%2ebecomes%252e.
If an IPS only decodes the payload once, it reads %252e, decodes it to %2e, sees no malicious . character, and allows the traffic. Always check if your security appliances normalize (fully decode) traffic before applying regex signatures.
Master your detection engineering skills with more realistic scenarios.
Explore more CSA simulations