@abtnode/router-provider 1.16.38-beta-20250116-083413-dbd33222 → 1.16.38-beta-20250118-033334-2da05ae8

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (51) hide show
  1. package/lib/nginx/includes/security/crs4/rules/REQUEST-900-EXCLUSION-RULES-BEFORE-CRS.conf.example +200 -0
  2. package/lib/nginx/includes/security/crs4/rules/REQUEST-901-INITIALIZATION.conf +470 -0
  3. package/lib/nginx/includes/security/crs4/rules/REQUEST-905-COMMON-EXCEPTIONS.conf +57 -0
  4. package/lib/nginx/includes/security/crs4/rules/REQUEST-911-METHOD-ENFORCEMENT.conf +76 -0
  5. package/lib/nginx/includes/security/crs4/rules/REQUEST-913-SCANNER-DETECTION.conf +86 -0
  6. package/lib/nginx/includes/security/crs4/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf +1915 -0
  7. package/lib/nginx/includes/security/crs4/rules/REQUEST-921-PROTOCOL-ATTACK.conf +558 -0
  8. package/lib/nginx/includes/security/crs4/rules/REQUEST-922-MULTIPART-ATTACK.conf +120 -0
  9. package/lib/nginx/includes/security/crs4/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf +203 -0
  10. package/lib/nginx/includes/security/crs4/rules/REQUEST-931-APPLICATION-ATTACK-RFI.conf +189 -0
  11. package/lib/nginx/includes/security/crs4/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf +1875 -0
  12. package/lib/nginx/includes/security/crs4/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf +774 -0
  13. package/lib/nginx/includes/security/crs4/rules/REQUEST-934-APPLICATION-ATTACK-GENERIC.conf +366 -0
  14. package/lib/nginx/includes/security/crs4/rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf +1071 -0
  15. package/lib/nginx/includes/security/crs4/rules/REQUEST-942-APPLICATION-ATTACK-SQLI.conf +1978 -0
  16. package/lib/nginx/includes/security/crs4/rules/REQUEST-943-APPLICATION-ATTACK-SESSION-FIXATION.conf +132 -0
  17. package/lib/nginx/includes/security/crs4/rules/REQUEST-944-APPLICATION-ATTACK-JAVA.conf +463 -0
  18. package/lib/nginx/includes/security/crs4/rules/REQUEST-949-BLOCKING-EVALUATION.conf +270 -0
  19. package/lib/nginx/includes/security/crs4/rules/RESPONSE-950-DATA-LEAKAGES.conf +156 -0
  20. package/lib/nginx/includes/security/crs4/rules/RESPONSE-951-DATA-LEAKAGES-SQL.conf +417 -0
  21. package/lib/nginx/includes/security/crs4/rules/RESPONSE-952-DATA-LEAKAGES-JAVA.conf +108 -0
  22. package/lib/nginx/includes/security/crs4/rules/RESPONSE-953-DATA-LEAKAGES-PHP.conf +158 -0
  23. package/lib/nginx/includes/security/crs4/rules/RESPONSE-954-DATA-LEAKAGES-IIS.conf +152 -0
  24. package/lib/nginx/includes/security/crs4/rules/RESPONSE-955-WEB-SHELLS.conf +558 -0
  25. package/lib/nginx/includes/security/crs4/rules/RESPONSE-959-BLOCKING-EVALUATION.conf +280 -0
  26. package/lib/nginx/includes/security/crs4/rules/RESPONSE-980-CORRELATION.conf +138 -0
  27. package/lib/nginx/includes/security/crs4/rules/RESPONSE-999-EXCLUSION-RULES-AFTER-CRS.conf.example +76 -0
  28. package/lib/nginx/includes/security/crs4/rules/iis-errors.data +59 -0
  29. package/lib/nginx/includes/security/crs4/rules/java-classes.data +64 -0
  30. package/lib/nginx/includes/security/crs4/rules/java-code-leakages.data +17 -0
  31. package/lib/nginx/includes/security/crs4/rules/java-errors.data +10 -0
  32. package/lib/nginx/includes/security/crs4/rules/lfi-os-files.data +722 -0
  33. package/lib/nginx/includes/security/crs4/rules/php-config-directives.data +571 -0
  34. package/lib/nginx/includes/security/crs4/rules/php-errors-pl2.data +7 -0
  35. package/lib/nginx/includes/security/crs4/rules/php-errors.data +2147 -0
  36. package/lib/nginx/includes/security/crs4/rules/php-function-names-933150.data +245 -0
  37. package/lib/nginx/includes/security/crs4/rules/php-function-names-933151.data +2201 -0
  38. package/lib/nginx/includes/security/crs4/rules/php-variables.data +30 -0
  39. package/lib/nginx/includes/security/crs4/rules/restricted-files.data +284 -0
  40. package/lib/nginx/includes/security/crs4/rules/restricted-upload.data +177 -0
  41. package/lib/nginx/includes/security/crs4/rules/scanners-user-agents.data +119 -0
  42. package/lib/nginx/includes/security/crs4/rules/sql-errors.data +172 -0
  43. package/lib/nginx/includes/security/crs4/rules/ssrf.data +177 -0
  44. package/lib/nginx/includes/security/crs4/rules/unix-shell.data +670 -0
  45. package/lib/nginx/includes/security/crs4/rules/web-shells-php.data +167 -0
  46. package/lib/nginx/includes/security/crs4/rules/windows-powershell-commands.data +425 -0
  47. package/lib/nginx/includes/security/unicode.mapping +96 -0
  48. package/lib/nginx/index.js +50 -3
  49. package/lib/nginx/templates/security/crs4/crs-setup.conf.js +857 -0
  50. package/lib/nginx/templates/security/modsecurity.conf.js +244 -0
  51. package/package.json +7 -6
package/lib/nginx/includes/security/crs4/rules/RESPONSE-955-WEB-SHELLS.conf ADDED
@@ -0,0 +1,558 @@
1
+ # ------------------------------------------------------------------------
2
+ # OWASP CRS ver.4.9.0
3
+ # Copyright (c) 2006-2020 Trustwave and contributors. (not) All rights reserved.
4
+ # Copyright (c) 2021-2024 CRS project. All rights reserved.
5
+ #
6
+ # The OWASP CRS is distributed under
7
+ # Apache Software License (ASL) version 2
8
+ # Please see the enclosed LICENSE file for full details.
9
+ # ------------------------------------------------------------------------
10
+
11
+ #
12
+ # -= Paranoia Level 0 (empty) =- (apply unconditionally)
13
+ #
14
+
15
+ # Skip all rules if RESPONSE_BODY is compressed.
16
+ SecRule RESPONSE_HEADERS:Content-Encoding "@pm gzip compress deflate br zstd" \
17
+ "id:955010,\
18
+ phase:4,\
19
+ pass,\
20
+ nolog,\
21
+ tag:'OWASP_CRS',\
22
+ ver:'OWASP_CRS/4.9.0',\
23
+ skipAfter:END-RESPONSE-955-WEB-SHELLS"
24
+
25
+ SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 1" "id:955011,phase:3,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.9.0',skipAfter:END-RESPONSE-955-WEB-SHELLS"
26
+ SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 1" "id:955012,phase:4,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.9.0',skipAfter:END-RESPONSE-955-WEB-SHELLS"
27
+ #
28
+ # -= Paranoia Level 1 (default) =- (apply only when tx.detection_paranoia_level is sufficiently high: 1 or higher)
29
+ #
30
+
31
+ # For performance reasons, most of the shells are matched using this rule.
32
+ # This rule is intended for PHP web shells.
33
+ SecRule RESPONSE_BODY "@pmFromFile web-shells-php.data" \
34
+ "id:955100,\
35
+ phase:4,\
36
+ block,\
37
+ capture,\
38
+ t:none,\
39
+ msg:'Web shell detected',\
40
+ logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}',\
41
+ tag:'language-php',\
42
+ tag:'platform-multi',\
43
+ tag:'attack-rce',\
44
+ tag:'paranoia-level/1',\
45
+ tag:'OWASP_CRS',\
46
+ tag:'capec/1000/225/122/17/650',\
47
+ ver:'OWASP_CRS/4.9.0',\
48
+ severity:'CRITICAL',\
49
+ setvar:'tx.outbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'"
50
+
51
+ # r57 web shell
52
+ SecRule RESPONSE_BODY "@rx <title>r57 Shell Version [0-9.]+</title>|<title>r57 shell</title>" \
53
+ "id:955110,\
54
+ phase:4,\
55
+ block,\
56
+ capture,\
57
+ t:none,\
58
+ msg:'r57 web shell',\
59
+ logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}',\
60
+ tag:'language-php',\
61
+ tag:'platform-multi',\
62
+ tag:'attack-rce',\
63
+ tag:'paranoia-level/1',\
64
+ tag:'OWASP_CRS',\
65
+ tag:'capec/1000/225/122/17/650',\
66
+ ver:'OWASP_CRS/4.9.0',\
67
+ severity:'CRITICAL',\
68
+ setvar:'tx.outbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'"
69
+
70
+ # WSO web shell
71
+ SecRule RESPONSE_BODY "@rx ^<html><head><meta http-equiv='Content-Type' content='text/html; charset=(?:Windows-1251|UTF-8)?'><title>.*?(?: -)? W[Ss][Oo] [0-9.]+</title>" \
72
+ "id:955120,\
73
+ phase:4,\
74
+ block,\
75
+ capture,\
76
+ t:none,\
77
+ msg:'WSO web shell',\
78
+ logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}',\
79
+ tag:'language-php',\
80
+ tag:'platform-multi',\
81
+ tag:'attack-rce',\
82
+ tag:'paranoia-level/1',\
83
+ tag:'OWASP_CRS',\
84
+ tag:'capec/1000/225/122/17/650',\
85
+ ver:'OWASP_CRS/4.9.0',\
86
+ severity:'CRITICAL',\
87
+ setvar:'tx.outbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'"
88
+
89
+ # b4tm4n web shell (https://github.com/k4mpr3t/b4tm4n)
90
+ SecRule RESPONSE_BODY "@rx B4TM4N SH3LL</title>.*<meta name='author' content='k4mpr3t'/>" \
91
+ "id:955130,\
92
+ phase:4,\
93
+ block,\
94
+ capture,\
95
+ t:none,\
96
+ msg:'b4tm4n web shell',\
97
+ logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}',\
98
+ tag:'language-php',\
99
+ tag:'platform-multi',\
100
+ tag:'attack-rce',\
101
+ tag:'paranoia-level/1',\
102
+ tag:'OWASP_CRS',\
103
+ tag:'capec/1000/225/122/17/650',\
104
+ ver:'OWASP_CRS/4.9.0',\
105
+ severity:'CRITICAL',\
106
+ setvar:'tx.outbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'"
107
+
108
+ # Mini Shell web shell
109
+ SecRule RESPONSE_BODY "@rx <title>Mini Shell</title>.*Developed By LameHacker" \
110
+ "id:955140,\
111
+ phase:4,\
112
+ block,\
113
+ capture,\
114
+ t:none,\
115
+ msg:'Mini Shell web shell',\
116
+ logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}',\
117
+ tag:'language-php',\
118
+ tag:'platform-multi',\
119
+ tag:'attack-rce',\
120
+ tag:'paranoia-level/1',\
121
+ tag:'OWASP_CRS',\
122
+ tag:'capec/1000/225/122/17/650',\
123
+ ver:'OWASP_CRS/4.9.0',\
124
+ severity:'CRITICAL',\
125
+ setvar:'tx.outbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'"
126
+
127
+ # Ashiyane web shell
128
+ SecRule RESPONSE_BODY "@rx <title>\.:: .* ~ Ashiyane V [0-9.]+ ::\.</title>" \
129
+ "id:955150,\
130
+ phase:4,\
131
+ block,\
132
+ capture,\
133
+ t:none,\
134
+ msg:'Ashiyane web shell',\
135
+ logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}',\
136
+ tag:'language-php',\
137
+ tag:'platform-multi',\
138
+ tag:'attack-rce',\
139
+ tag:'paranoia-level/1',\
140
+ tag:'OWASP_CRS',\
141
+ tag:'capec/1000/225/122/17/650',\
142
+ ver:'OWASP_CRS/4.9.0',\
143
+ severity:'CRITICAL',\
144
+ setvar:'tx.outbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'"
145
+
146
+ # Symlink_Sa web shell
147
+ SecRule RESPONSE_BODY "@rx <title>Symlink_Sa [0-9.]+</title>" \
148
+ "id:955160,\
149
+ phase:4,\
150
+ block,\
151
+ capture,\
152
+ t:none,\
153
+ msg:'Symlink_Sa web shell',\
154
+ logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}',\
155
+ tag:'language-php',\
156
+ tag:'platform-multi',\
157
+ tag:'attack-rce',\
158
+ tag:'paranoia-level/1',\
159
+ tag:'OWASP_CRS',\
160
+ tag:'capec/1000/225/122/17/650',\
161
+ ver:'OWASP_CRS/4.9.0',\
162
+ severity:'CRITICAL',\
163
+ setvar:'tx.outbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'"
164
+
165
+ # CasuS web shell
166
+ SecRule RESPONSE_BODY "@rx <title>CasuS [0-9.]+ by MafiABoY</title>" \
167
+ "id:955170,\
168
+ phase:4,\
169
+ block,\
170
+ capture,\
171
+ t:none,\
172
+ msg:'CasuS web shell',\
173
+ logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}',\
174
+ tag:'language-php',\
175
+ tag:'platform-multi',\
176
+ tag:'attack-rce',\
177
+ tag:'paranoia-level/1',\
178
+ tag:'OWASP_CRS',\
179
+ tag:'capec/1000/225/122/17/650',\
180
+ ver:'OWASP_CRS/4.9.0',\
181
+ severity:'CRITICAL',\
182
+ setvar:'tx.outbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'"
183
+
184
+ # GRP WebShell
185
+ SecRule RESPONSE_BODY "@rx ^<html>\r\n<head>\r\n<title>GRP WebShell [0-9.]+ " \
186
+ "id:955180,\
187
+ phase:4,\
188
+ block,\
189
+ capture,\
190
+ t:none,\
191
+ msg:'GRP WebShell',\
192
+ logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}',\
193
+ tag:'language-php',\
194
+ tag:'platform-multi',\
195
+ tag:'attack-rce',\
196
+ tag:'paranoia-level/1',\
197
+ tag:'OWASP_CRS',\
198
+ tag:'capec/1000/225/122/17/650',\
199
+ ver:'OWASP_CRS/4.9.0',\
200
+ severity:'CRITICAL',\
201
+ setvar:'tx.outbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'"
202
+
203
+ # NGHshell web shell
204
+ SecRule RESPONSE_BODY "@rx <small>NGHshell [0-9.]+ by Cr4sh</body></html>\n$" \
205
+ "id:955190,\
206
+ phase:4,\
207
+ block,\
208
+ capture,\
209
+ t:none,\
210
+ msg:'NGHshell web shell',\
211
+ logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}',\
212
+ tag:'language-php',\
213
+ tag:'platform-multi',\
214
+ tag:'attack-rce',\
215
+ tag:'paranoia-level/1',\
216
+ tag:'OWASP_CRS',\
217
+ tag:'capec/1000/225/122/17/650',\
218
+ ver:'OWASP_CRS/4.9.0',\
219
+ severity:'CRITICAL',\
220
+ setvar:'tx.outbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'"
221
+
222
+ # SimAttacker web shell
223
+ SecRule RESPONSE_BODY "@rx <title>SimAttacker - (?:Version|Vrsion) : [0-9.]+ - " \
224
+ "id:955200,\
225
+ phase:4,\
226
+ block,\
227
+ capture,\
228
+ t:none,\
229
+ msg:'SimAttacker web shell',\
230
+ logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}',\
231
+ tag:'language-php',\
232
+ tag:'platform-multi',\
233
+ tag:'attack-rce',\
234
+ tag:'paranoia-level/1',\
235
+ tag:'OWASP_CRS',\
236
+ tag:'capec/1000/225/122/17/650',\
237
+ ver:'OWASP_CRS/4.9.0',\
238
+ severity:'CRITICAL',\
239
+ setvar:'tx.outbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'"
240
+
241
+ # Unknown web shell
242
+ SecRule RESPONSE_BODY "@rx ^<!DOCTYPE html>\n<html>\n<!-- By Artyum .*<title>Web Shell</title>" \
243
+ "id:955210,\
244
+ phase:4,\
245
+ block,\
246
+ capture,\
247
+ t:none,\
248
+ msg:'Unknown web shell',\
249
+ logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}',\
250
+ tag:'language-php',\
251
+ tag:'platform-multi',\
252
+ tag:'attack-rce',\
253
+ tag:'paranoia-level/1',\
254
+ tag:'OWASP_CRS',\
255
+ tag:'capec/1000/225/122/17/650',\
256
+ ver:'OWASP_CRS/4.9.0',\
257
+ severity:'CRITICAL',\
258
+ setvar:'tx.outbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'"
259
+
260
+ # lama's'hell web shell
261
+ SecRule RESPONSE_BODY "@rx <title>lama's'hell v. [0-9.]+</title>" \
262
+ "id:955220,\
263
+ phase:4,\
264
+ block,\
265
+ capture,\
266
+ t:none,\
267
+ msg:'lama\'s\'hell web shell',\
268
+ logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}',\
269
+ tag:'language-php',\
270
+ tag:'platform-multi',\
271
+ tag:'attack-rce',\
272
+ tag:'paranoia-level/1',\
273
+ tag:'OWASP_CRS',\
274
+ tag:'capec/1000/225/122/17/650',\
275
+ ver:'OWASP_CRS/4.9.0',\
276
+ severity:'CRITICAL',\
277
+ setvar:'tx.outbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'"
278
+
279
+ # lostDC web shell
280
+ SecRule RESPONSE_BODY "@rx ^ *<html>\n[ ]+<head>\n[ ]+<title>lostDC - " \
281
+ "id:955230,\
282
+ phase:4,\
283
+ block,\
284
+ capture,\
285
+ t:none,\
286
+ msg:'lostDC web shell',\
287
+ logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}',\
288
+ tag:'language-php',\
289
+ tag:'platform-multi',\
290
+ tag:'attack-rce',\
291
+ tag:'paranoia-level/1',\
292
+ tag:'OWASP_CRS',\
293
+ tag:'capec/1000/225/122/17/650',\
294
+ ver:'OWASP_CRS/4.9.0',\
295
+ severity:'CRITICAL',\
296
+ setvar:'tx.outbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'"
297
+
298
+ # Unknown web shell
299
+ SecRule RESPONSE_BODY "@rx ^<title>PHP Web Shell</title>\r\n<html>\r\n<body>\r\n <!-- Replaces command with Base64-encoded Data -->" \
300
+ "id:955240,\
301
+ phase:4,\
302
+ block,\
303
+ capture,\
304
+ t:none,\
305
+ msg:'Unknown web shell',\
306
+ logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}',\
307
+ tag:'language-php',\
308
+ tag:'platform-multi',\
309
+ tag:'attack-rce',\
310
+ tag:'paranoia-level/1',\
311
+ tag:'OWASP_CRS',\
312
+ tag:'capec/1000/225/122/17/650',\
313
+ ver:'OWASP_CRS/4.9.0',\
314
+ severity:'CRITICAL',\
315
+ setvar:'tx.outbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'"
316
+
317
+ # Unknown web shell
318
+ SecRule RESPONSE_BODY "@rx ^<html>\n<head>\n<div align=\"left\"><font size=\"1\">Input command :</font></div>\n<form name=\"cmd\" method=\"POST\" enctype=\"multipart/form-data\">" \
319
+ "id:955250,\
320
+ phase:4,\
321
+ block,\
322
+ capture,\
323
+ t:none,\
324
+ msg:'Unknown web shell',\
325
+ logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}',\
326
+ tag:'language-php',\
327
+ tag:'platform-multi',\
328
+ tag:'attack-rce',\
329
+ tag:'paranoia-level/1',\
330
+ tag:'OWASP_CRS',\
331
+ tag:'capec/1000/225/122/17/650',\
332
+ ver:'OWASP_CRS/4.9.0',\
333
+ severity:'CRITICAL',\
334
+ setvar:'tx.outbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'"
335
+
336
+ # Ru24PostWebShell web shell
337
+ # Removed '- ' from the end of the pattern so this file won't get detected as
338
+ # malware by Windows Defender.
339
+ SecRule RESPONSE_BODY "@rx ^<html>\n<head>\n<title>Ru24PostWebShell " \
340
+ "id:955260,\
341
+ phase:4,\
342
+ block,\
343
+ capture,\
344
+ t:none,\
345
+ msg:'Ru24PostWebShell web shell',\
346
+ logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}',\
347
+ tag:'language-php',\
348
+ tag:'platform-multi',\
349
+ tag:'attack-rce',\
350
+ tag:'paranoia-level/1',\
351
+ tag:'OWASP_CRS',\
352
+ tag:'capec/1000/225/122/17/650',\
353
+ ver:'OWASP_CRS/4.9.0',\
354
+ severity:'CRITICAL',\
355
+ setvar:'tx.outbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'"
356
+
357
+ # s72 Shell web shell
358
+ SecRule RESPONSE_BODY "@rx <title>s72 Shell v[0-9.]+ Codinf by Cr@zy_King</title>" \
359
+ "id:955270,\
360
+ phase:4,\
361
+ block,\
362
+ capture,\
363
+ t:none,\
364
+ msg:'s72 Shell web shell',\
365
+ logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}',\
366
+ tag:'language-php',\
367
+ tag:'platform-multi',\
368
+ tag:'attack-rce',\
369
+ tag:'paranoia-level/1',\
370
+ tag:'OWASP_CRS',\
371
+ tag:'capec/1000/225/122/17/650',\
372
+ ver:'OWASP_CRS/4.9.0',\
373
+ severity:'CRITICAL',\
374
+ setvar:'tx.outbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'"
375
+
376
+ # PhpSpy web shell
377
+ SecRule RESPONSE_BODY "@rx ^<html>\r\n<head>\r\n<meta http-equiv=\"Content-Type\" content=\"text/html; charset=gb2312\">\r\n<title>PhpSpy Ver [0-9]+</title>" \
378
+ "id:955280,\
379
+ phase:4,\
380
+ block,\
381
+ capture,\
382
+ t:none,\
383
+ msg:'PhpSpy web shell',\
384
+ logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}',\
385
+ tag:'language-php',\
386
+ tag:'platform-multi',\
387
+ tag:'attack-rce',\
388
+ tag:'paranoia-level/1',\
389
+ tag:'OWASP_CRS',\
390
+ tag:'capec/1000/225/122/17/650',\
391
+ ver:'OWASP_CRS/4.9.0',\
392
+ severity:'CRITICAL',\
393
+ setvar:'tx.outbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'"
394
+
395
+ # g00nshell web shell
396
+ SecRule RESPONSE_BODY "@rx ^ <html>\n\n<head>\n\n<title>g00nshell v[0-9.]+ " \
397
+ "id:955290,\
398
+ phase:4,\
399
+ block,\
400
+ capture,\
401
+ t:none,\
402
+ msg:'g00nshell web shell',\
403
+ logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}',\
404
+ tag:'language-php',\
405
+ tag:'platform-multi',\
406
+ tag:'attack-rce',\
407
+ tag:'paranoia-level/1',\
408
+ tag:'OWASP_CRS',\
409
+ tag:'capec/1000/225/122/17/650',\
410
+ ver:'OWASP_CRS/4.9.0',\
411
+ severity:'CRITICAL',\
412
+ setvar:'tx.outbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'"
413
+
414
+ # PuNkHoLic shell web shell
415
+ # Various versions has this text written little differently so we need to do
416
+ # t:removeWhitespace and t:lowercase.
417
+ SecRule RESPONSE_BODY "@contains <title>punkholicshell</title>" \
418
+ "id:955300,\
419
+ phase:4,\
420
+ block,\
421
+ capture,\
422
+ t:none,t:removeWhitespace,t:lowercase,\
423
+ msg:'PuNkHoLic shell web shell',\
424
+ logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}',\
425
+ tag:'language-php',\
426
+ tag:'platform-multi',\
427
+ tag:'attack-rce',\
428
+ tag:'paranoia-level/1',\
429
+ tag:'OWASP_CRS',\
430
+ tag:'capec/1000/225/122/17/650',\
431
+ ver:'OWASP_CRS/4.9.0',\
432
+ severity:'CRITICAL',\
433
+ setvar:'tx.outbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'"
434
+
435
+ # azrail web shell
436
+ SecRule RESPONSE_BODY "@rx ^<html>\n <head>\n <title>azrail [0-9.]+ by C-W-M</title>" \
437
+ "id:955310,\
438
+ phase:4,\
439
+ block,\
440
+ capture,\
441
+ t:none,\
442
+ msg:'azrail web shell',\
443
+ logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}',\
444
+ tag:'language-php',\
445
+ tag:'platform-multi',\
446
+ tag:'attack-rce',\
447
+ tag:'paranoia-level/1',\
448
+ tag:'OWASP_CRS',\
449
+ tag:'capec/1000/225/122/17/650',\
450
+ ver:'OWASP_CRS/4.9.0',\
451
+ severity:'CRITICAL',\
452
+ setvar:'tx.outbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'"
453
+
454
+ # SmEvK_PaThAn Shell web shell
455
+ SecRule RESPONSE_BODY "@rx >SmEvK_PaThAn Shell v[0-9]+ coded by <a href=" \
456
+ "id:955320,\
457
+ phase:4,\
458
+ block,\
459
+ capture,\
460
+ t:none,\
461
+ msg:'SmEvK_PaThAn Shell web shell',\
462
+ logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}',\
463
+ tag:'language-php',\
464
+ tag:'platform-multi',\
465
+ tag:'attack-rce',\
466
+ tag:'paranoia-level/1',\
467
+ tag:'OWASP_CRS',\
468
+ tag:'capec/1000/225/122/17/650',\
469
+ ver:'OWASP_CRS/4.9.0',\
470
+ severity:'CRITICAL',\
471
+ setvar:'tx.outbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'"
472
+
473
+ # Shell I web shell
474
+ SecRule RESPONSE_BODY "@rx ^<html>\n<title>.*? ~ Shell I</title>\n<head>\n<style>" \
475
+ "id:955330,\
476
+ phase:4,\
477
+ block,\
478
+ capture,\
479
+ t:none,\
480
+ msg:'Shell I web shell',\
481
+ logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}',\
482
+ tag:'language-php',\
483
+ tag:'platform-multi',\
484
+ tag:'attack-rce',\
485
+ tag:'paranoia-level/1',\
486
+ tag:'OWASP_CRS',\
487
+ tag:'capec/1000/225/122/17/650',\
488
+ ver:'OWASP_CRS/4.9.0',\
489
+ severity:'CRITICAL',\
490
+ setvar:'tx.outbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'"
491
+
492
+ # b374k m1n1 web shell
493
+ SecRule RESPONSE_BODY "@rx ^ <html><head><title>:: b374k m1n1 [0-9.]+ ::</title>" \
494
+ "id:955340,\
495
+ phase:4,\
496
+ block,\
497
+ capture,\
498
+ t:none,\
499
+ msg:'b374k m1n1 web shell',\
500
+ logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}',\
501
+ tag:'language-php',\
502
+ tag:'platform-multi',\
503
+ tag:'attack-rce',\
504
+ tag:'paranoia-level/1',\
505
+ tag:'OWASP_CRS',\
506
+ tag:'capec/1000/225/122/17/650',\
507
+ ver:'OWASP_CRS/4.9.0',\
508
+ severity:'CRITICAL',\
509
+ setvar:'tx.outbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'"
510
+
511
+
512
+
513
+ SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 2" "id:955013,phase:3,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.9.0',skipAfter:END-RESPONSE-955-WEB-SHELLS"
514
+ SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 2" "id:955014,phase:4,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.9.0',skipAfter:END-RESPONSE-955-WEB-SHELLS"
515
+ #
516
+ # -= Paranoia Level 2 =- (apply only when tx.detection_paranoia_level is sufficiently high: 2 or higher)
517
+ #
518
+
519
+ # webadmin.php file manager
520
+ # This is placed in PL2 because of too generic pattern.
521
+ SecRule RESPONSE_BODY "@contains <h1 style=\"margin-bottom: 0\">webadmin.php</h1>" \
522
+ "id:955350,\
523
+ phase:4,\
524
+ block,\
525
+ capture,\
526
+ t:none,\
527
+ msg:'webadmin.php file manager',\
528
+ logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}',\
529
+ tag:'language-php',\
530
+ tag:'platform-multi',\
531
+ tag:'attack-rce',\
532
+ tag:'paranoia-level/2',\
533
+ tag:'OWASP_CRS',\
534
+ tag:'capec/1000/225/122/17/650',\
535
+ ver:'OWASP_CRS/4.9.0',\
536
+ severity:'CRITICAL',\
537
+ setvar:'tx.outbound_anomaly_score_pl2=+%{tx.critical_anomaly_score}'"
538
+
539
+ SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 3" "id:955015,phase:3,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.9.0',skipAfter:END-RESPONSE-955-WEB-SHELLS"
540
+ SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 3" "id:955016,phase:4,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.9.0',skipAfter:END-RESPONSE-955-WEB-SHELLS"
541
+ #
542
+ # -= Paranoia Level 3 =- (apply only when tx.detection_paranoia_level is sufficiently high: 3 or higher)
543
+ #
544
+
545
+
546
+
547
+ SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 4" "id:955017,phase:3,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.9.0',skipAfter:END-RESPONSE-955-WEB-SHELLS"
548
+ SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 4" "id:955018,phase:4,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.9.0',skipAfter:END-RESPONSE-955-WEB-SHELLS"
549
+ #
550
+ # -= Paranoia Level 4 =- (apply only when tx.detection_paranoia_level is sufficiently high: 4 or higher)
551
+ #
552
+
553
+
554
+
555
+ #
556
+ # -= Paranoia Levels Finished =-
557
+ #
558
+ SecMarker "END-RESPONSE-955-WEB-SHELLS"