ATT&CK T1595.003 - Web Directory Brute Force (Gobuster/DirBuster)

Darshan Thummar@Mighty

•updated Jun 10, 2026•0•0•5

This rule detects web directory brute-force attempts by identifying the 'gobuster' string in the HTTP User-Agent header. Gobuster is a common tool used for directory and file enumeration on web servers, often as part of reconnaissance or vulnerability scanning activities. The rule specifically targets HTTP traffic flowing to the server.