Executive Leadership Directory Scraping

Darshan Thummar@Mighty

•updated Jun 10, 2026•0•0•2

This rule detects potential executive leadership directory scraping attempts. It triggers an alert when a client makes 10 or more HTTP requests containing the word "leadership" (case-insensitive) in the URI within a 30-second window. This behavior could indicate an attacker attempting to gather information about key personnel for social engineering or other reconnaissance purposes.