2024-12-21 00:35:03 +00:00
|
|
|
# Apache ModSecurity rules for ATTACK
|
|
|
|
|
SecRuleEngine On
|
|
|
|
|
|
2025-01-16 14:02:19 +01:00
|
|
|
SecRule REQUEST_URI "\[nr\]\+\(\?:s\|location\|refresh\|\(\?:set\-\)\?cookie\|\(\?:x\-\)\?\(\?:forwarded\-\(\?:for\|host\|server\)\|host\|via\|remote\-ip\|remote\-addr\|originating\-IP\)\)s\*:" "id:1151,phase:1,deny,status:403,log,msg:'attack attack detected'"
|
|
|
|
|
SecRule REQUEST_URI "\(\?:bhttp/d\|<\(\?:html\|meta\)b\)" "id:1148,phase:1,deny,status:403,log,msg:'attack attack detected'"
|
|
|
|
|
SecRule REQUEST_URI "@gt\ 1" "id:1158,phase:1,deny,status:403,log,msg:'attack attack detected'"
|
|
|
|
|
SecRule REQUEST_URI "\[nr\]" "id:1154,phase:1,deny,status:403,log,msg:'attack attack detected'"
|
|
|
|
|
SecRule REQUEST_URI "content\-transfer\-encoding:\(\.\*\)" "id:1034,phase:1,deny,status:403,log,msg:'attack attack detected'"
|
|
|
|
|
SecRule REQUEST_URI "\[nr\]" "id:1150,phase:1,deny,status:403,log,msg:'attack attack detected'"
|
|
|
|
|
SecRule REQUEST_URI "\^\[\^sv,;\]\+\[sv,;\]\.\*\?b\(\?:\(\(\?:tex\|multipar\)t\|application\)\|\(\(\?:audi\|vide\)o\|image\|cs\[sv\]\|\(\?:vn\|relate\)d\|p\(\?:df\|lain\)\|json\|\(\?:soa\|cs\)p\|x\(\?:ml\|\-www\-form\-urlencoded\)\|form\-data\|x\-amf\|\(\?:octe\|repor\)t\|stream\)\|\(\[\+/\]\)\)b" "id:1155,phase:1,deny,status:403,log,msg:'attack attack detected'"
|
|
|
|
|
SecRule REQUEST_URI "\[rn\]W\*\?\(\?:content\-\(\?:type\|length\)\|set\-cookie\|location\):s\*w" "id:1147,phase:1,deny,status:403,log,msg:'attack attack detected'"
|
|
|
|
|
SecRule REQUEST_URI "@gt\ 0" "id:1156,phase:1,deny,status:403,log,msg:'attack attack detected'"
|
|
|
|
|
SecRule REQUEST_URI "\." "id:1157,phase:1,deny,status:403,log,msg:'attack attack detected'"
|
|
|
|
|
SecRule REQUEST_URI "\[nr\]" "id:1152,phase:1,deny,status:403,log,msg:'attack attack detected'"
|
|
|
|
|
SecRule REQUEST_URI "\[nr\]" "id:1149,phase:1,deny,status:403,log,msg:'attack attack detected'"
|
|
|
|
|
SecRule REQUEST_URI "\(\?:get\|post\|head\|options\|connect\|put\|delete\|trace\|track\|patch\|propfind\|propatch\|mkcol\|copy\|move\|lock\|unlock\)s\+\[\^s\]\+s\+http/d" "id:1146,phase:1,deny,status:403,log,msg:'attack attack detected'"
|
|
|
|
|
SecRule REQUEST_URI "\^content\-types\*:s\*\(\.\*\)\$" "id:1033,phase:1,deny,status:403,log,msg:'attack attack detected'"
|
|
|
|
|
SecRule REQUEST_URI "unix:\[\^\|\]\*\|" "id:1153,phase:1,deny,status:403,log,msg:'attack attack detected'"
|
|
|
|
|
SecRule REQUEST_URI "TX:paramcounter_\(\.\*\)" "id:1159,phase:1,deny,status:403,log,msg:'attack attack detected'"
|
