225 lines
7.4 KiB
XML
225 lines
7.4 KiB
XML
<!-- @(#) $Id: ./etc/rules/web_rules.xml, 2013/02/28 dcid Exp $
|
|
|
|
-
|
|
- Official Web access rules for OSSEC.
|
|
-
|
|
- Copyright (C) 2009 Trend Micro Inc.
|
|
- All rights reserved.
|
|
-
|
|
- This program is a free software; you can redistribute it
|
|
- and/or modify it under the terms of the GNU General Public
|
|
- License (version 2) as published by the FSF - Free Software
|
|
- Foundation.
|
|
-
|
|
- License details: http://www.ossec.net/en/licensing.html
|
|
-->
|
|
|
|
|
|
<group name="web,accesslog,">
|
|
<rule id="31100" level="0">
|
|
<category>web-log</category>
|
|
<description>Access log messages grouped.</description>
|
|
</rule>
|
|
|
|
<rule id="31108" level="0">
|
|
<if_sid>31100</if_sid>
|
|
<id_pcre2>^2|^3</id_pcre2>
|
|
<compiled_rule>is_simple_http_request</compiled_rule>
|
|
<description>Ignored URLs (simple queries).</description>
|
|
</rule>
|
|
|
|
<rule id="31101" level="5">
|
|
<if_sid>31100</if_sid>
|
|
<id_pcre2>^4</id_pcre2>
|
|
<description>Web server 400 error code.</description>
|
|
</rule>
|
|
|
|
<rule id="31102" level="0">
|
|
<if_sid>31101</if_sid>
|
|
<url_pcre2>\.jpg$|\.gif$|favicon\.ico$|\.png$|robots\.txt$|\.css$|\.js$|\.jpeg$</url_pcre2>
|
|
<compiled_rule>is_simple_http_request</compiled_rule>
|
|
<description>Ignored extensions on 400 error codes.</description>
|
|
</rule>
|
|
|
|
<rule id="31103" level="6">
|
|
<if_sid>31100,31108</if_sid>
|
|
<url_pcre2>=select%20|select\+|insert%20|%20from%20|%20where%20|union%20|</url_pcre2>
|
|
<url_pcre2>union\+|where\+|null,null|xp_cmdshell</url_pcre2>
|
|
<description>SQL injection attempt.</description>
|
|
<group>attack,sql_injection,</group>
|
|
</rule>
|
|
|
|
<rule id="31104" level="6">
|
|
<if_sid>31100</if_sid>
|
|
|
|
<!-- Attempt to do directory transversal, simple sql injections,
|
|
- or access to the etc or bin directory (unix). -->
|
|
<url_pcre2>%027|%00|%01|%7f|%2E%2E|%0A|%0D|\.\./\.\.|\.\.\\\.\.|echo;|</url_pcre2>
|
|
<url_pcre2>cmd\.exe|root\.exe|_mem_bin|msadc|/winnt/|/boot\.ini|</url_pcre2>
|
|
<url_pcre2>/x90/|default\.ida|/sumthin|nsiislog\.dll|chmod%|wget%|cd%20|</url_pcre2>
|
|
<url_pcre2>exec%20|\.\./\.\.//|%5C\.\./%5C|\./\./\./\./|2e%2e%5c%2e|\\x5C\\x5C</url_pcre2>
|
|
<description>Common web attack.</description>
|
|
<group>attack,</group>
|
|
</rule>
|
|
|
|
<rule id="31105" level="6">
|
|
<if_sid>31100</if_sid>
|
|
<url_pcre2>%3Cscript|%3C%2Fscript|script>|script%3E|SRC=javascript|IMG%20|</url_pcre2>
|
|
<url_pcre2>%20ONLOAD=|INPUT%20|iframe%20</url_pcre2>
|
|
<description>XSS (Cross Site Scripting) attempt.</description>
|
|
<group>attack,</group>
|
|
</rule>
|
|
|
|
<rule id="31106" level="6">
|
|
<if_sid>31103, 31104, 31105</if_sid>
|
|
<id_pcre2>^200</id_pcre2>
|
|
<description>A web attack returned code 200 (success).</description>
|
|
<group>attack,</group>
|
|
</rule>
|
|
|
|
<rule id="31110" level="6">
|
|
<if_sid>31100</if_sid>
|
|
<url_pcre2>\?-d|\?-s|\?-a|\?-b|\?-w</url_pcre2>
|
|
<description>PHP CGI-bin vulnerability attempt.</description>
|
|
<group>attack,</group>
|
|
</rule>
|
|
|
|
<rule id="31109" level="6">
|
|
<if_sid>31100</if_sid>
|
|
<url_pcre2>\+as\+varchar</url_pcre2>
|
|
<pcre2>%2Bchar\(\d+\)%2Bchar\(\d+\)%2Bchar\(\d+\)%2Bchar\(\d+\)%2Bchar\(\d+\)%2Bchar\(\d+\)</pcre2>
|
|
<description>MSSQL Injection attempt (/ur.php, urchin.js)</description>
|
|
<group>attack,</group>
|
|
</rule>
|
|
|
|
|
|
<!-- If your site have a search engine, you may need to ignore
|
|
- it in here.
|
|
-->
|
|
<rule id="31107" level="0">
|
|
<if_sid>31103, 31104, 31105</if_sid>
|
|
<url_pcre2>^/search\.php\?search=|^/index\.php\?searchword=</url_pcre2>
|
|
<description>Ignored URLs for the web attacks</description>
|
|
</rule>
|
|
|
|
<rule id="31115" level="13" maxsize="7900">
|
|
<if_sid>31100</if_sid>
|
|
<description>URL too long. Higher than allowed on most </description>
|
|
<description>browsers. Possible attack.</description>
|
|
<group>invalid_access,</group>
|
|
</rule>
|
|
|
|
|
|
<!-- 500 error codes, server error
|
|
- http://www.w3.org/Protocols/rfc2616/rfc2616-sec10.html
|
|
-->
|
|
<rule id="31120" level="5">
|
|
<if_sid>31100</if_sid>
|
|
<id_pcre2>^50</id_pcre2>
|
|
<description>Web server 500 error code (server error).</description>
|
|
</rule>
|
|
|
|
<rule id="31121" level="4">
|
|
<if_sid>31120</if_sid>
|
|
<id_pcre2>^501</id_pcre2>
|
|
<description>Web server 501 error code (Not Implemented).</description>
|
|
</rule>
|
|
|
|
<rule id="31122" level="5">
|
|
<if_sid>31120</if_sid>
|
|
<id_pcre2>^500</id_pcre2>
|
|
<options>alert_by_email</options>
|
|
<description>Web server 500 error code (Internal Error).</description>
|
|
<group>system_error,</group>
|
|
</rule>
|
|
|
|
<rule id="31123" level="4">
|
|
<if_sid>31120</if_sid>
|
|
<id_pcre2>^503</id_pcre2>
|
|
<options>alert_by_email</options>
|
|
<description>Web server 503 error code (Service unavailable).</description>
|
|
</rule>
|
|
|
|
|
|
<!-- Rules to ignore crawlers -->
|
|
<rule id="31140" level="0">
|
|
<if_sid>31101</if_sid>
|
|
<compiled_rule>is_valid_crawler</compiled_rule>
|
|
<description>Ignoring google/msn/yahoo bots.</description>
|
|
</rule>
|
|
|
|
<!-- Ignoring nginx 499's -->
|
|
<rule id="31141" level="0">
|
|
<if_sid>31101</if_sid>
|
|
<id_pcre2>^499</id_pcre2>
|
|
<description>Ignored 499's on nginx.</description>
|
|
</rule>
|
|
|
|
|
|
<rule id="31151" level="10" frequency="12" timeframe="90">
|
|
<if_matched_sid>31101</if_matched_sid>
|
|
<same_source_ip />
|
|
<description>Multiple web server 400 error codes </description>
|
|
<description>from same source ip.</description>
|
|
<group>web_scan,recon,</group>
|
|
</rule>
|
|
|
|
<rule id="31152" level="10" frequency="6" timeframe="120">
|
|
<if_matched_sid>31103</if_matched_sid>
|
|
<same_source_ip />
|
|
<description>Multiple SQL injection attempts from same </description>
|
|
<description>source ip.</description>
|
|
<group>attack,sql_injection,</group>
|
|
</rule>
|
|
|
|
<rule id="31153" level="10" frequency="8" timeframe="120">
|
|
<if_matched_sid>31104</if_matched_sid>
|
|
<same_source_ip />
|
|
<description>Multiple common web attacks from same source ip.</description>
|
|
<group>attack,</group>
|
|
</rule>
|
|
|
|
<rule id="31154" level="10" frequency="8" timeframe="120">
|
|
<if_matched_sid>31105</if_matched_sid>
|
|
<same_source_ip />
|
|
<description>Multiple XSS (Cross Site Scripting) attempts </description>
|
|
<description>from same source ip.</description>
|
|
<group>attack,</group>
|
|
</rule>
|
|
|
|
<rule id="31161" level="10" frequency="12" timeframe="120">
|
|
<if_matched_sid>31121</if_matched_sid>
|
|
<same_source_ip />
|
|
<description>Multiple web server 501 error code (Not Implemented).</description>
|
|
<group>web_scan,recon,</group>
|
|
</rule>
|
|
|
|
<rule id="31162" level="10" frequency="12" timeframe="120">
|
|
<if_matched_sid>31122</if_matched_sid>
|
|
<same_source_ip />
|
|
<description>Multiple web server 500 error code (Internal Error).</description>
|
|
<group>system_error,</group>
|
|
</rule>
|
|
|
|
<rule id="31163" level="10" frequency="12" timeframe="120">
|
|
<if_matched_sid>31123</if_matched_sid>
|
|
<same_source_ip />
|
|
<description>Multiple web server 503 error code (Service unavailable).</description>
|
|
<group>web_scan,recon,</group>
|
|
</rule>
|
|
|
|
<rule id="31164" level="6">
|
|
<if_sid>31100</if_sid>
|
|
<url_pcre2>=%27|select%2B|insert%2B|%2Bfrom%2B|%2Bwhere%2B|%2Bunion%2B</url_pcre2>
|
|
<description>SQL injection attempt.</description>
|
|
<group>attack,sqlinjection,</group>
|
|
</rule>
|
|
|
|
<rule id="31165" level="6">
|
|
<if_sid>31100</if_sid>
|
|
<url_pcre2>%EF%BC%87|%EF%BC%87|%EF%BC%87|%2531|%u0053%u0045</url_pcre2>
|
|
<description>SQL injection attempt.</description>
|
|
<group>attack,sqlinjection,</group>
|
|
</rule>
|
|
|
|
</group> <!-- Web access log -->
|