Job Listing Page Enumeration for Tech Stack Recon

Darshan Thummar@Mighty

•updated Jun 10, 2026•0•0•2

This rule detects enumeration of job listing pages on web servers, likely for tech stack reconnaissance. It triggers when a client makes 15 or more HTTP requests containing 'jobs' in the URI within a 30-second window to the same server. This behavior can indicate an attacker attempting to gather information about an organization's technology stack by analyzing job descriptions, which often mention specific software, systems, or programming languages.