# Apache ModSecurity rules for SHELLS SecRuleEngine On SecRule REQUEST_URI "\^rnrnGRP\ WebShell\ \[0\-9\.\]\+" "id:1329,phase:1,deny,status:403,log,msg:'shells attack detected'" SecRule REQUEST_URI "<title>Symlink_Sa\ \[0\-9\.\]\+" "id:1327,phase:1,deny,status:403,log,msg:'shells attack detected'" SecRule REQUEST_URI "\.::\ \.\*\ \~\ Ashiyane\ V\ \[0\-9\.\]\+\ ::\." "id:1326,phase:1,deny,status:403,log,msg:'shells attack detected'" SecRule REQUEST_URI ">SmEvK_PaThAn\ Shell\ v\[0\-9\]\+\ coded\ by\ SimAttacker\ \-\ \(\?:Version\|Vrsion\)\ :\ \[0\-9\.\]\+\ \-" "id:1331,phase:1,deny,status:403,log,msg:'shells attack detected'" SecRule REQUEST_URI "\^rnrnrnPhpSpy\ Ver\ \[0\-9\]\+" "id:1339,phase:1,deny,status:403,log,msg:'shells attack detected'" SecRule REQUEST_URI "\(r57\ Shell\ Version\ \[0\-9\.\]\+\|r57\ shell\)" "id:1322,phase:1,deny,status:403,log,msg:'shells attack detected'" SecRule REQUEST_URI "\^\ nnnng00nshell\ v\[0\-9\.\]\+" "id:1340,phase:1,deny,status:403,log,msg:'shells attack detected'" SecRule REQUEST_URI "B4TM4N\ SH3LL\.\*" "id:1324,phase:1,deny,status:403,log,msg:'shells attack detected'" SecRule REQUEST_URI "\^n\ \ \ \ \ \ n\ \ \ \ \ \ \ \ \ \ \ \ \ azrail\ \[0\-9\.\]\+\ by\ C\-W\-M" "id:1342,phase:1,deny,status:403,log,msg:'shells attack detected'" SecRule REQUEST_URI "\^n\.\*\?\ \~\ Shell\ Inn