Employee Directory Enumeration via Web

Darshan Thummar@Mighty

•updated Jun 10, 2026•0•0•1

This rule detects potential employee directory enumeration attempts via web requests. It triggers when HTTP URI content contains both 'directory' and 'people' (case-insensitive) within a 60-second window from the same source IP, with a threshold of 10 occurrences. This behavior is indicative of an attacker attempting to discover employee information or organizational structure.