ATT&CK T1595.003 - Web Directory Brute Force (DirBuster)

Darshan Thummar@Mighty

•updated Jun 10, 2026•0•0•5

This rule detects web directory brute-force attempts by identifying HTTP requests where the User-Agent header contains the string "DirBuster". DirBuster is a well-known tool used for brute-forcing directories and file names on web servers.