Source Code Enumeration Detection by Keyword — Sigma Rule

Rule metadata and linked tags

Author: James Ahearn. Source status: test; severity: medium. Source dates: 2019-06-08 / 2022-10-05.

{
  "category": "webserver"
}

Pinned original Sigma rule · Detection Rule License 1.1

Source SHA-256: 800ce8ce4590c55ba14b386ca6fcf1d2e761aa8f886869964a99e63650f8088b

Detection logic

Original source YAML. Source-tag agreement is not proof of complete semantic coverage. This rule has not been compiled for a SIEM backend or validated against live telemetry here.

title: Source Code Enumeration Detection by Keyword
id: 953d460b-f810-420a-97a2-cfca4c98e602
status: test
description: Detects source code enumeration that use GET requests by keyword searches in URL strings
references:
    - https://pentester.land/tutorials/2018/10/25/source-code-disclosure-via-exposed-git-folder.html
    - https://medium.com/@logicbomb_1/bugbounty-how-i-was-able-to-download-the-source-code-of-indias-largest-telecom-service-52cf5c5640a1
author: James Ahearn
date: 2019-06-08
modified: 2022-10-05
tags:
    - attack.discovery
    - attack.t1083
logsource:
    category: webserver
detection:
    keywords:
        - '.git/'
    condition: keywords
falsepositives:
    - Unknown
level: medium

Original YAML and metadata in JSON

False positives

• Unknown

Source references

• https://pentester.land/tutorials/2018/10/25/source-code-disclosure-via-exposed-git-folder.html
• https://medium.com/@logicbomb_1/bugbounty-how-i-was-able-to-download-the-source-code-of-indias-largest-telecom-service-52cf5c5640a1