1name: crowdsecurity/vpatch-git-config
2description: "Detect access to .git files"
3rules:
4  - zones:
5      - URI
6    transform:
7      - lowercase
8    match:
9      type: regex
10      value: '/\.git/(config|head|index|refs|hooks|)$|/\.svn/(wc\.db|entries|format|)$|/\.hg/(hgrc|)$'
11labels:
12  type: scan
13  service: http
14  confidence: 3
15  spoofable: 0
16  behavior: "http:scan"
17  label: "Access to .git file"
18  classification:
19    - attack.T1595
20