2024-12-21 00:35:03 +00:00
|
|
|
# Apache ModSecurity rules for ATTACK
|
|
|
|
|
SecRuleEngine On
|
|
|
|
|
|
2025-01-18 00:24:13 +00:00
|
|
|
SecRule REQUEST_URI "\^\[\^sv,;\]\+\[sv,;\]\.\*\?\(\?:application/\(\?:\.\+\+\)\?json\|\(\?:application/\(\?:soap\+\)\?\|text/\)xml\)" "id:1069,phase:1,deny,status:403,log,msg:'attack attack detected'"
|
|
|
|
|
SecRule REQUEST_URI "\." "id:1074,phase:1,deny,status:403,log,msg:'attack attack detected'"
|
|
|
|
|
SecRule REQUEST_URI "\^\[\^sv,;\]\+\[sv,;\]\.\*\?b\(\?:\(\(\?:tex\|multipar\)t\|application\)\|\(\(\?:audi\|vide\)o\|image\|cs\[sv\]\|\(\?:vn\|relate\)d\|p\(\?:df\|lain\)\|json\|\(\?:soa\|cs\)p\|x\(\?:ml\|\-www\-form\-urlencoded\)\|form\-data\|x\-amf\|\(\?:octe\|repor\)t\|stream\)\|\(\[\+/\]\)\)b" "id:1072,phase:1,deny,status:403,log,msg:'attack attack detected'"
|
|
|
|
|
SecRule REQUEST_URI "\[nr\]" "id:1066,phase:1,deny,status:403,log,msg:'attack attack detected'"
|
|
|
|
|
SecRule REQUEST_URI "@gt\ 1" "id:1075,phase:1,deny,status:403,log,msg:'attack attack detected'"
|
|
|
|
|
SecRule REQUEST_URI "\(\?:get\|post\|head\|options\|connect\|put\|delete\|trace\|track\|patch\|propfind\|propatch\|mkcol\|copy\|move\|lock\|unlock\)s\+\[\^s\]\+s\+http/d" "id:1062,phase:1,deny,status:403,log,msg:'attack attack detected'"
|
|
|
|
|
SecRule REQUEST_URI "unix:\[\^\|\]\*\|" "id:1070,phase:1,deny,status:403,log,msg:'attack attack detected'"
|
|
|
|
|
SecRule REQUEST_URI "TX:paramcounter_\(\.\*\)" "id:1076,phase:1,deny,status:403,log,msg:'attack attack detected'"
|
|
|
|
|
SecRule REQUEST_URI "\[nr\]" "id:1068,phase:1,deny,status:403,log,msg:'attack attack detected'"
|
|
|
|
|
SecRule REQUEST_URI "\[nr\]\+\(\?:s\|location\|refresh\|\(\?:set\-\)\?cookie\|\(\?:x\-\)\?\(\?:forwarded\-\(\?:for\|host\|server\)\|host\|via\|remote\-ip\|remote\-addr\|originating\-IP\)\)s\*:" "id:1067,phase:1,deny,status:403,log,msg:'attack attack detected'"
|
|
|
|
|
SecRule REQUEST_URI "\[nr\]" "id:1065,phase:1,deny,status:403,log,msg:'attack attack detected'"
|
|
|
|
|
SecRule REQUEST_URI "\^content\-types\*:s\*\(\.\*\)\$" "id:1054,phase:1,deny,status:403,log,msg:'attack attack detected'"
|
|
|
|
|
SecRule REQUEST_URI "\[nr\]" "id:1071,phase:1,deny,status:403,log,msg:'attack attack detected'"
|
|
|
|
|
SecRule REQUEST_URI "\(\?:bhttp/d\|<\(\?:html\|meta\)b\)" "id:1064,phase:1,deny,status:403,log,msg:'attack attack detected'"
|
|
|
|
|
SecRule REQUEST_URI "content\-transfer\-encoding:\(\.\*\)" "id:1055,phase:1,deny,status:403,log,msg:'attack attack detected'"
|
|
|
|
|
SecRule REQUEST_URI "\[rn\]W\*\?\(\?:content\-\(\?:type\|length\)\|set\-cookie\|location\):s\*w" "id:1063,phase:1,deny,status:403,log,msg:'attack attack detected'"
|
|
|
|
|
SecRule REQUEST_URI "@gt\ 0" "id:1073,phase:1,deny,status:403,log,msg:'attack attack detected'"
|
