-
Notifications
You must be signed in to change notification settings - Fork 0
Expand file tree
/
Copy pathrules.yaml
More file actions
181 lines (169 loc) · 5.44 KB
/
Copy pathrules.yaml
File metadata and controls
181 lines (169 loc) · 5.44 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
# This file defines rules for identifying suspicious web log entries in WebLogHunter.
# Rules follow a Sigma-style format to detect patterns in log attributes (e.g., IP, URI,
# status). Upon identification a risk score is assigned to highlight potential threats.
#
# - Each rule specifies a single 'selection' block with conditions to match log entries.
# Multiple selections are currently unsupported.
# - Supported fields include: ip, method, status, request_uri, referrer, user_agent,
# request_count, resp_size, uri_risk (URI-based risk score), status_risk (status code-based
# risk score), method_risk (method-based risk score).
# - Sigma-style value modifiers:
# - List-based: 'in' (matches any value in list), 'notin' (excludes list values),
# 'cidr' (matches IPs in CIDR ranges, e.g., '192.168.1.0/24').
# - String-based: 'contains' (substring match), 'startswith', 'endswith', 'regex'.
# - Numeric (int/float): 'gte' (>=), 'gt' (>), 'lt' (<), 'lte' (<=), 'eq' (==), 'ne' (!=).
# - Rule application: When multiple rules match a log entry, the rule with the highest
# risk_score is applied. Matching entries are tagged with the risk score and rule title.
#
# At some point better support for Sigma will be implemented. For now this will do.
#
# Example:
# A rule detects suspicious log entries by:
# - Matching a URI like '/file.csv.php' (e.g. a potential webshell bypassed extension filtering),
# which generates a uri_risk score of 70 or higher based on configuration.
# - Checking for a HTTP status code (200, 201, or 202), indicating the request was processed.
# - Assigning a risk_score of 90.0 and tagging the log entry with the rule title
# 'Suspicious URI with Successful Status' to flag the potential threat.
- title: Large Request Count & Server Error
id: 323e4567-e89b-12d3-a456-426614174002
description: Detect high number of repeat URI path requests with server error
status: stable
logsource:
category: access_log
detection:
selection:
request_count|gte: 500
status: [500, 502, 503, 504]
resp_size|gte: 25
condition: selection
tags:
- risk_score: 80.0
# This rule can be an issue with Wordpress and other frameworks that return a status 200 on a invalid uri request.
- title: Suspicious URI & OK Status
id: 123e4567-e89b-12d3-a456-426614174000
description: Detect high risk uri with successful status code
status: stable
logsource:
category: access_log
detection:
selection:
uri_risk|gte: 70
status: [200, 201, 202]
resp_size|gte: 25
condition: selection
tags:
- risk_score: 75.0
- title: Shell Command & Status Success
id: b23e4567-e89b-12d3-a456-4266141a44643
description: expr shell command
status: stable
logsource:
category: access_log
detection:
selection:
status: [200, 201, 202]
resp_size|gte: 25
request_uri|contains: 'whoami'
tags:
- risk_score: 71.1
- title: Moderately suspicious URI & Server Error
id: 723e4567-e89b-12d3-a456-426614174007
description: Detect moderate risk uri with server error status
status: stable
logsource:
category: access_log
detection:
selection:
resp_size|gte: 25
uri_risk|gte: 40
status: [500, 502, 503, 504]
condition: selection
tags:
- risk_score: 68.0
- title: Suspicious Referrer
id: c23e4568-f89a-24c3-c456-456718174013
description: Detect suspicious referrer
status: stable
logsource:
category: access_log
detection:
selection:
referrer|contains: fofa.info
condition: selection
tags:
- risk_score: 67.5
- title: Repeating Requests & Server Error
id: 423e4567-e89b-12d3-a456-426614174003
description: Detect medium request count with server error
status: stable
logsource:
category: access_log
detection:
selection:
resp_size|gte: 25
request_count|gte: 200
request_count|lt: 500
status: [500, 502, 503, 504]
condition: selection
tags:
- risk_score: 42.0
- title: Repeating POST Requests Status OK or Forbidden
id: 623e4567-e89b-12d3-a456-426614174005
description: Repeating POST Request
status: stable
logsource:
category: access_log
detection:
selection:
request_count|gte: 200
resp_size|gte: 25
status: [200, 201, 202, 403]
method:
- 'POST'
condition: selection
tags:
- risk_score: 41.0
- title: Status Code Risk
id: 223e4567-e89b-12d3-a456-426614174001
description: Status code
status: stable
logsource:
category: access_log
detection:
selection:
status_risk|gte: 70
condition: selection
level: medium
fields:
- status_risk
tags:
- risk_score: 40.0
# - title: Suspicious Client IP & Status OK/SError
# id: b23e4567-e89b-12d3-a456-426614174011
# description: Detect requests from suspicious IP ranges
# status: stable
# logsource:
# category: access_log
# detection:
# selection:
# ip|cidr: ['20.20.20.0/20', '30.30.30.0/20']
# status: [200, 201, 202, 500, 502, 503, 504]
# request_uri|notin: ['/']
# tags:
# - risk_score: 26.0
# - title: Suspicious User Agent
# id: b23e4567-e89b-12d3-a456-426614174011
# description: Detect suspicious user agent
# status: stable
# logsource:
# category: access_log
# detection:
# selection:
# user_agent:
# - 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) Gecko/20100101 Firefox/120.0'
# condition: selection
# level: low
# fields:
# - user_agent
# tags:
# - risk_score: 19.0