Webserver URL Enumeration for Exposed .git Paths via GET Keyword

Alerts when web requests include .git/ in the URL, suggesting source code enumeration against version control paths.

FreeReviewedSigma · Medium · v2

Category: webserver
Author: James Ahearn (SigmaHQ), DRL 1.1
Published: 2019-06-08
Updated: 2026-07-31

ATT&CK techniques

Discovery

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
- T1083File and Directory Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags web requests where the URL contains the keyword “.git/”, indicating attempts to enumerate or access exposed Git-related paths. Attackers often use this pattern to discover and download source code from misconfigured repositories. Detection relies on webserver request telemetry that includes the full URL observed for GET traffic.

Reporting behind it

Related detections9 linkedT1083 — drag to rearrange

Possible Nagios XI Path Traversal via Graphtemplates Directory Parameter

Suspicious Credential String Enumeration via findstr to Temp Directory

Suspicious ipconfig Reconnaissance Output Redirected to CentreStack Log File

Possible osTicket PHP Filter Chain Injection via Anonymous Ticket Endpoints (via webserver)

Possible Local File Inclusion Path Traversal Targeting CentreStack Web.config

PUA: TruffleHog Execution on Windows via trufflehog.exe Process Launch

Linux Process Execution of TruffleHog with Secret-Scanning Platforms

Windows: Notepad Password File Discovery via Process Creation

Linux process execution of shell via nice utility

Webserver URL Enumeration for Exposed .git Paths via GET Keyword

Pivot detection · T1083 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

webserver-url-keyword-match-for-source-code-enumeration-via-git-paths-953d460b

title: Webserver URL Enumeration for Exposed .git Paths via GET Keyword
id: 63850321-fd85-44dd-a21e-210f2a9948e0
status: test
description: This rule flags web requests where the URL contains the keyword “.git/”, indicating attempts to enumerate or access exposed Git-related paths. Attackers often use this pattern to discover and download source code from misconfigured repositories. Detection relies on webserver request telemetry that includes the full URL observed for GET traffic.
references:
  - https://pentester.land/tutorials/2018/10/25/source-code-disclosure-via-exposed-git-folder.html
  - https://medium.com/@logicbomb_1/bugbounty-how-i-was-able-to-download-the-source-code-of-indias-largest-telecom-service-52cf5c5640a1
  - https://github.com/SigmaHQ/sigma/blob/master/rules/web/webserver_generic/web_source_code_enumeration.yml
author: James Ahearn, Huntrule Team
date: 2019-06-08
modified: 2022-10-05
tags:
  - attack.discovery
  - attack.t1083
logsource:
  category: webserver
detection:
  keywords:
    - .git/
  condition: keywords
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: 953d460b-f810-420a-97a2-cfca4c98e602
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL