# Apache ModSecurity rules for SHELLS SecRuleEngine On SecRule REQUEST_URI "@lt 1" "id:1231,phase:1,deny,status:403,log,msg:'shells attack detected'" SecRule REQUEST_URI "@lt 1" "id:1232,phase:1,deny,status:403,log,msg:'shells attack detected'" SecRule REQUEST_URI "@pmFromFile web-shells-php.data" "id:1233,phase:1,deny,status:403,log,msg:'shells attack detected'" SecRule REQUEST_URI "@rx (r57 Shell Version [0-9.]+|r57 shell)" "id:1234,phase:1,deny,status:403,log,msg:'shells attack detected'" SecRule REQUEST_URI "@rx ^.*? - WSO [0-9.]+" "id:1235,phase:1,deny,status:403,log,msg:'shells attack detected'" SecRule REQUEST_URI "@rx B4TM4N SH3LL.*" "id:1236,phase:1,deny,status:403,log,msg:'shells attack detected'" SecRule REQUEST_URI "@rx Mini Shell.*Developed By LameHacker" "id:1237,phase:1,deny,status:403,log,msg:'shells attack detected'" SecRule REQUEST_URI "@rx .:: .* ~ Ashiyane V [0-9.]+ ::." "id:1238,phase:1,deny,status:403,log,msg:'shells attack detected'" SecRule REQUEST_URI "@rx Symlink_Sa [0-9.]+" "id:1239,phase:1,deny,status:403,log,msg:'shells attack detected'" SecRule REQUEST_URI "@rx CasuS [0-9.]+ by MafiABoY" "id:1240,phase:1,deny,status:403,log,msg:'shells attack detected'" SecRule REQUEST_URI "@rx ^rnrnGRP WebShell [0-9.]+" "id:1241,phase:1,deny,status:403,log,msg:'shells attack detected'" SecRule REQUEST_URI "@rx <small>NGHshell [0-9.]+ by Cr4sh</body></html>n$" "id:1242,phase:1,deny,status:403,log,msg:'shells attack detected'" SecRule REQUEST_URI "@rx <title>SimAttacker - (?:Version|Vrsion) : [0-9.]+ -" "id:1243,phase:1,deny,status:403,log,msg:'shells attack detected'" SecRule REQUEST_URI "@rx ^<!DOCTYPE html>n<html>n<!-- By Artyum .*<title>Web Shell" "id:1244,phase:1,deny,status:403,log,msg:'shells attack detected'" SecRule REQUEST_URI "@rx lama's'hell v. [0-9.]+" "id:1245,phase:1,deny,status:403,log,msg:'shells attack detected'" SecRule REQUEST_URI "@rx ^ *n[ ]+n[ ]+lostDC -" "id:1246,phase:1,deny,status:403,log,msg:'shells attack detected'" SecRule REQUEST_URI "@rx ^<title>PHP Web Shellrnrnrn " "id:1247,phase:1,deny,status:403,log,msg:'shells attack detected'" SecRule REQUEST_URI "@rx ^nn
Input command :
n
" "id:1248,phase:1,deny,status:403,log,msg:'shells attack detected'" SecRule REQUEST_URI "@rx ^nnRu24PostWebShell -" "id:1249,phase:1,deny,status:403,log,msg:'shells attack detected'" SecRule REQUEST_URI "@rx <title>s72 Shell v[0-9.]+ Codinf by Cr@zy_King" "id:1250,phase:1,deny,status:403,log,msg:'shells attack detected'" SecRule REQUEST_URI "@rx ^rnrnrnPhpSpy Ver [0-9]+" "id:1251,phase:1,deny,status:403,log,msg:'shells attack detected'" SecRule REQUEST_URI "@rx ^ nnnng00nshell v[0-9.]+" "id:1252,phase:1,deny,status:403,log,msg:'shells attack detected'" SecRule REQUEST_URI "@contains <title>punkholicshell" "id:1253,phase:1,deny,status:403,log,msg:'shells attack detected'" SecRule REQUEST_URI "@rx ^n n azrail [0-9.]+ by C-W-M" "id:1254,phase:1,deny,status:403,log,msg:'shells attack detected'" SecRule REQUEST_URI "@rx >SmEvK_PaThAn Shell v[0-9]+ coded by n.*? ~ Shell Inn