2024-12-21 00:35:03 +00:00
|
|
|
# Apache ModSecurity rules for SHELLS
|
|
|
|
|
SecRuleEngine On
|
|
|
|
|
|
|
|
|
|
SecRule REQUEST_URI "@lt 1" "id:1000,phase:1,deny,status:403,log,msg:'shells attack detected'"
|
|
|
|
|
SecRule REQUEST_URI "@lt 1" "id:1000,phase:1,deny,status:403,log,msg:'shells attack detected'"
|
|
|
|
|
SecRule REQUEST_URI "@pmFromFile web-shells-php.data" "id:1000,phase:1,deny,status:403,log,msg:'shells attack detected'"
|
2024-12-22 00:28:28 +00:00
|
|
|
SecRule REQUEST_URI "@rx (<title>r57 Shell Version [0-9.]+</title>|<title>r57 shell</title>)" "id:1000,phase:1,deny,status:403,log,msg:'shells attack detected'"
|
|
|
|
|
SecRule REQUEST_URI "@rx ^<html><head><meta http-equiv='Content-Type' content='text/html; charset=Windows-1251'><title>.*? - WSO [0-9.]+</title>" "id:1000,phase:1,deny,status:403,log,msg:'shells attack detected'"
|
2024-12-21 00:35:03 +00:00
|
|
|
SecRule REQUEST_URI "@rx B4TM4N SH3LL</title>.*<meta name='author' content='k4mpr3t'/>" "id:1000,phase:1,deny,status:403,log,msg:'shells attack detected'"
|
|
|
|
|
SecRule REQUEST_URI "@rx <title>Mini Shell</title>.*Developed By LameHacker" "id:1000,phase:1,deny,status:403,log,msg:'shells attack detected'"
|
|
|
|
|
SecRule REQUEST_URI "@rx <title>.:: .* ~ Ashiyane V [0-9.]+ ::.</title>" "id:1000,phase:1,deny,status:403,log,msg:'shells attack detected'"
|
|
|
|
|
SecRule REQUEST_URI "@rx <title>Symlink_Sa [0-9.]+</title>" "id:1000,phase:1,deny,status:403,log,msg:'shells attack detected'"
|
|
|
|
|
SecRule REQUEST_URI "@rx <title>CasuS [0-9.]+ by MafiABoY</title>" "id:1000,phase:1,deny,status:403,log,msg:'shells attack detected'"
|
|
|
|
|
SecRule REQUEST_URI "@rx ^<html>rn<head>rn<title>GRP WebShell [0-9.]+" "id:1000,phase:1,deny,status:403,log,msg:'shells attack detected'"
|
|
|
|
|
SecRule REQUEST_URI "@rx <small>NGHshell [0-9.]+ by Cr4sh</body></html>n$" "id:1000,phase:1,deny,status:403,log,msg:'shells attack detected'"
|
|
|
|
|
SecRule REQUEST_URI "@rx <title>SimAttacker - (?:Version|Vrsion) : [0-9.]+ -" "id:1000,phase:1,deny,status:403,log,msg:'shells attack detected'"
|
|
|
|
|
SecRule REQUEST_URI "@rx ^<!DOCTYPE html>n<html>n<!-- By Artyum .*<title>Web Shell</title>" "id:1000,phase:1,deny,status:403,log,msg:'shells attack detected'"
|
|
|
|
|
SecRule REQUEST_URI "@rx <title>lama's'hell v. [0-9.]+</title>" "id:1000,phase:1,deny,status:403,log,msg:'shells attack detected'"
|
|
|
|
|
SecRule REQUEST_URI "@rx ^ *<html>n[ ]+<head>n[ ]+<title>lostDC -" "id:1000,phase:1,deny,status:403,log,msg:'shells attack detected'"
|
|
|
|
|
SecRule REQUEST_URI "@rx ^<title>PHP Web Shell</title>rn<html>rn<body>rn <!-- Replaces command with Base64-encoded Data -->" "id:1000,phase:1,deny,status:403,log,msg:'shells attack detected'"
|
2024-12-29 23:20:18 +00:00
|
|
|
SecRule REQUEST_URI "@rx ^<html>n<head>n<div align="left"><font size="1">Input command :</font></div>n<form name="cmd" method="POST" enctype="multipart/form-data">" "id:1000,phase:1,deny,status:403,log,msg:'shells attack detected'"
|
2024-12-22 00:28:28 +00:00
|
|
|
SecRule REQUEST_URI "@rx ^<html>n<head>n<title>Ru24PostWebShell -" "id:1000,phase:1,deny,status:403,log,msg:'shells attack detected'"
|
2024-12-21 00:35:03 +00:00
|
|
|
SecRule REQUEST_URI "@rx <title>s72 Shell v[0-9.]+ Codinf by Cr@zy_King</title>" "id:1000,phase:1,deny,status:403,log,msg:'shells attack detected'"
|
2024-12-29 23:20:18 +00:00
|
|
|
SecRule REQUEST_URI "@rx ^<html>rn<head>rn<meta http-equiv="Content-Type" content="text/html; charset=gb2312">rn<title>PhpSpy Ver [0-9]+</title>" "id:1000,phase:1,deny,status:403,log,msg:'shells attack detected'"
|
2024-12-21 00:35:03 +00:00
|
|
|
SecRule REQUEST_URI "@rx ^ <html>nn<head>nn<title>g00nshell v[0-9.]+" "id:1000,phase:1,deny,status:403,log,msg:'shells attack detected'"
|
|
|
|
|
SecRule REQUEST_URI "@contains <title>punkholicshell</title>" "id:1000,phase:1,deny,status:403,log,msg:'shells attack detected'"
|
|
|
|
|
SecRule REQUEST_URI "@rx ^<html>n <head>n <title>azrail [0-9.]+ by C-W-M</title>" "id:1000,phase:1,deny,status:403,log,msg:'shells attack detected'"
|
|
|
|
|
SecRule REQUEST_URI "@rx >SmEvK_PaThAn Shell v[0-9]+ coded by <a href=" "id:1000,phase:1,deny,status:403,log,msg:'shells attack detected'"
|
|
|
|
|
SecRule REQUEST_URI "@rx ^<html>n<title>.*? ~ Shell I</title>n<head>n<style>" "id:1000,phase:1,deny,status:403,log,msg:'shells attack detected'"
|
|
|
|
|
SecRule REQUEST_URI "@rx ^ <html><head><title>:: b374k m1n1 [0-9.]+ ::</title>" "id:1000,phase:1,deny,status:403,log,msg:'shells attack detected'"
|
|
|
|
|
SecRule REQUEST_URI "@lt 2" "id:1000,phase:1,deny,status:403,log,msg:'shells attack detected'"
|
|
|
|
|
SecRule REQUEST_URI "@lt 2" "id:1000,phase:1,deny,status:403,log,msg:'shells attack detected'"
|
2024-12-29 23:20:18 +00:00
|
|
|
SecRule REQUEST_URI "@contains <h1 style="margin-bottom: 0">webadmin.php</h1>" "id:1000,phase:1,deny,status:403,log,msg:'shells attack detected'"
|
2024-12-21 00:35:03 +00:00
|
|
|
SecRule REQUEST_URI "@lt 3" "id:1000,phase:1,deny,status:403,log,msg:'shells attack detected'"
|
|
|
|
|
SecRule REQUEST_URI "@lt 3" "id:1000,phase:1,deny,status:403,log,msg:'shells attack detected'"
|
|
|
|
|
SecRule REQUEST_URI "@lt 4" "id:1000,phase:1,deny,status:403,log,msg:'shells attack detected'"
|
|
|
|
|
SecRule REQUEST_URI "@lt 4" "id:1000,phase:1,deny,status:403,log,msg:'shells attack detected'"
|
