Possible Source Code Enumeration Detection by Keyword (via webserver)

title: Possible Source Code Enumeration Detection by Keyword (via webserver)
id: 4a3cc0a6-93dc-5b9c-b7c0-d119faa0049c
status: stable
description: This rule detects source code enumeration that use GET requests by keyword searches in URL strings
references:
    - https://attack.mitre.org/techniques/T1083/
    - https://pentester.land/tutorials/2018/10/25/source-code-disclosure-via-exposed-git-folder.html
    - https://medium.com/@logicbomb_1/bugbounty-how-i-was-able-to-download-the-source-code-of-indias-largest-telecom-service-52cf5c5640a1
author: Huntrule Team
date: 2026-06-18
tags:
    - attack.discovery
    - attack.t1083
logsource:
    category: webserver
detection:
    keywords:
        - '.git/'
    condition: keywords
falsepositives:
    - Unknown
level: medium