Filesystem enumeration is the automated discovery of files and directories on a system. An attacker uses it to map what is stored on a host, where sensitive data lives, and which paths are worth copying, modifying, or deleting. Enumeration may involve listing directory contents, checking permissions, searching for filenames, or collecting metadata such as timestamps and sizes.
In cyber security, this matters because file discovery often turns a foothold into data theft. Once an intruder can enumerate a filesystem, they can identify engineering documents, source code, configuration files, credentials, or staging locations for exfiltration. Defenders look for unusual directory listing activity, suspicious file access patterns, and the creation of temporary inventory files such as file lists. Limiting access, segmenting sensitive repositories, and monitoring for bulk reads help reduce the impact of this technique.