Refer to the exhibit.

The alert shown is based on aSnort rulefor aUnicode directory traversal attack against IIS web servers(Microsoft platform). The key detail here is the payload content"../..%c0%af../"which is a classic IIS-specific exploit related toCVE-2000-0884.

Since the company only usesUnix systems, they arenot vulnerableto this IIS-specific attack. Therefore, these alerts are triggered by irrelevant traffic or misapplied signatures, resulting inFalse Positives.

As defined in the Cisco CyberOps guide:

“False Positive: an alert is generated for traffic that is not actually malicious or relevant to the protected environment”.