Hardware Asset Inventory Enumeration via Web

Darshan Thummar@Mighty

•updated Jun 10, 2026•0•0•2

This rule detects attempts to enumerate hardware asset inventory information via web requests. It triggers when HTTP requests contain both 'asset' and 'inventory' in the URI, indicating a potential reconnaissance activity to gather information about an organization's hardware assets. A threshold of 10 such requests within 60 seconds from the same source IP is set to reduce false positives.