Detectionmediumtest

Source Code Enumeration Detection by Keyword

Detects source code enumeration that use GET requests by keyword searches in URL strings

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

James AhearnCreated Sat Jun 08Updated Wed Oct 05953d460b-f810-420a-97a2-cfca4c98e602web

Log Source

Web Server Log

CategoryWeb Server Log← raw: webserver

HTTP access logs from web servers capturing request paths, methods, and status codes.

Detection Logic

detection:
    keywords:
        - '.git/'
    condition: keywords

False Positives

Unknown

False positive likelihood has not been assessed. Additional context may be needed during triage.

References

MITRE ATT&CK

Tactics

Techniques

Rule Metadata

Rule ID

953d460b-f810-420a-97a2-cfca4c98e602

Status

test

Level

medium

Type

Detection

Created

Sat Jun 08

Modified

Wed Oct 05

Author

Path

rules/web/webserver_generic/web_source_code_enumeration.yml

Raw Tags

attack.discoveryattack.t1083