Definition
Canonical reference for trav behavior.
Display name
Path traversal attempts
How to read this signal
This annotator represents a behavioral pattern, not a claim of identity.
It’s designed to help you understand why certain traffic looks suspicious, automated,
probing, or exploit-oriented — and to support consistent reporting across the Syndu system.
Explanation
Flags directory/path traversal indicators (e.g., patterns intended to escape a web root or reach system files). Used to explain suspicious path crafting commonly seen during reconnaissance. False positives can occur if user-supplied content legitimately contains traversal-like strings, so repetition and endpoint context matter.
