Email Directory Enumeration Detected

Darshan Thummar@Mighty

•updated Jun 10, 2026•0•0•4

This rule detects potential email directory enumeration attempts by monitoring HTTP requests. It triggers when a client sends 10 or more HTTP requests within 30 seconds to the server, where each request URI contains both an '@' symbol and '.com'. This pattern is indicative of an attacker trying to guess valid email addresses on a domain.