From a0496d7fec5dfacd5e0bc324826e888c0b163e8e Mon Sep 17 00:00:00 2001
From: "andre.bolinhas" <andre.bolinhas@articatech.com>
Date: Mon, 7 Sep 2026 18:08:38 +0100
Subject: [PATCH] Update OWASP CRS rules to v4.29.0

Automated update via update-feed.sh
CRS version: v4.29.0
Rules extracted: 282
---
 rulesets.json | 78 +++++++++++++++++++++++++++++------------------------------
 1 file changed, 39 insertions(+), 39 deletions(-)

diff --git a/rulesets.json b/rulesets.json
index d4f8b74..c063092 100644
--- a/rulesets.json
+++ b/rulesets.json
@@ -1,5 +1,5 @@
 {
-  "build_datetime": "2026-09-07T16:55:58Z",
+  "build_datetime": "2026-09-07T17:08:37Z",
   "owasp_top_10": {
     "version": "2025",
     "url": "https://owasp.org/Top10/2025/",
@@ -140,7 +140,7 @@
           "name": "Attempted multipart/form-data bypass",
           "pattern": "(?i)^(?:&(?:(?:[acegilnorsuz]acut|[aeiou]grav|[aino]tild)e|[c-elnr-tz]caron|(?:[cgklnr-t]cedi|[aeiouy]um)l|[aceg-josuwy]circ|[au]ring|a(?:mp|pos)|nbsp|oslash);|[^\"';=\\x5c])*$",
           "targets": [
-            "all"
+            "filename"
           ],
           "action": "block",
           "score": 10,
@@ -161,9 +161,9 @@
           "name": "Content-Length HTTP header is not numeric",
           "pattern": "^\\d+$",
           "targets": [
-            "headers"
+            "all"
           ],
-          "action": "score",
+          "action": "block",
           "score": 10,
           "severity": "critical",
           "category": "protocol",
@@ -182,9 +182,9 @@
           "name": "Multiple/Conflicting Connection Header Data Found",
           "pattern": "\\b(?:keep-alive|close),\\s?(?:keep-alive|close)\\b",
           "targets": [
-            "headers"
+            "all"
           ],
-          "action": "score",
+          "action": "block",
           "score": 5,
           "severity": "medium",
           "category": "protocol",
@@ -225,9 +225,9 @@
           "name": "Empty Host Header",
           "pattern": "^$",
           "targets": [
-            "headers"
+            "all"
           ],
-          "action": "score",
+          "action": "block",
           "score": 10,
           "severity": "critical",
           "category": "protocol",
@@ -246,9 +246,9 @@
           "name": "Empty User Agent Header",
           "pattern": "^$",
           "targets": [
-            "headers"
+            "user_agent"
           ],
-          "action": "score",
+          "action": "block",
           "score": 3,
           "severity": "low",
           "category": "protocol",
@@ -267,9 +267,9 @@
           "name": "Host header is a numeric IP address",
           "pattern": "(?:^([\\d.]+|\\[[\\da-f:]+\\]|[\\da-f:]+)(:[\\d]+)?$)",
           "targets": [
-            "headers"
+            "all"
           ],
-          "action": "score",
+          "action": "block",
           "score": 5,
           "severity": "medium",
           "category": "protocol",
@@ -288,9 +288,9 @@
           "name": "Illegal Content-Type header",
           "pattern": "^[\\w/.+*-]+(?:\\s?;\\s*(?:action|boundary|charset|component|start(?:-info)?|type|version)\\s?=\\s?['\"\\w.()+,/:=?<>@#*-]+)*$",
           "targets": [
-            "headers"
+            "all"
           ],
-          "action": "score",
+          "action": "block",
           "score": 10,
           "severity": "critical",
           "category": "protocol",
@@ -309,9 +309,9 @@
           "name": "Multiple charsets detected in content type header",
           "pattern": "charset.*?charset",
           "targets": [
-            "headers"
+            "all"
           ],
-          "action": "score",
+          "action": "block",
           "score": 10,
           "severity": "critical",
           "category": "protocol",
@@ -351,9 +351,9 @@
           "name": "Illegal Accept header: charset parameter",
           "pattern": "^(?:(?:\\*|[^!\"\\(\\),/:-\\?\\[-\\]\\{\\}]+)/(?:\\*|[^!\"\\(\\),/:-\\?\\[-\\]\\{\\}]+)|\\*)(?:[\\s\\x0b]*;[\\s\\x0b]*(?:charset[\\s\\x0b]*=[\\s\\x0b]*\"?(?:iso-8859-15?|utf-8|windows-1252)\\b\"?|(?:[^\\s\\x0b-\"\\(\\),/:-\\?\\[-\\]c\\{\\}]|c(?:[^!\"\\(\\),/:-\\?\\[-\\]h\\{\\}]|h(?:[^!\"\\(\\),/:-\\?\\[-\\]a\\{\\}]|a(?:[^!\"\\(\\),/:-\\?\\[-\\]r\\{\\}]|r(?:[^!\"\\(\\),/:-\\?\\[-\\]s\\{\\}]|s(?:[^!\"\\(\\),/:-\\?\\[-\\]e\\{\\}]|e[^!\"\\(\\),/:-\\?\\[-\\]t\\{\\}]))))))[^!\"\\(\\),/:-\\?\\[-\\]\\{\\}]*[\\s\\x0b]*=[\\s\\x0b]*[^!\\(\\),/:-\\?\\[-\\]\\{\\}]+);?)*(?:[\\s\\x0b]*,[\\s\\x0b]*(?:(?:\\*|[^!\"\\(\\),/:-\\?\\[-\\]\\{\\}]+)/(?:\\*|[^!\"\\(\\),/:-\\?\\[-\\]\\{\\}]+)|\\*)(?:[\\s\\x0b]*;[\\s\\x0b]*(?:charset[\\s\\x0b]*=[\\s\\x0b]*\"?(?:iso-8859-15?|utf-8|windows-1252)\\b\"?|(?:[^\\s\\x0b-\"\\(\\),/:-\\?\\[-\\]c\\{\\}]|c(?:[^!\"\\(\\),/:-\\?\\[-\\]h\\{\\}]|h(?:[^!\"\\(\\),/:-\\?\\[-\\]a\\{\\}]|a(?:[^!\"\\(\\),/:-\\?\\[-\\]r\\{\\}]|r(?:[^!\"\\(\\),/:-\\?\\[-\\]s\\{\\}]|s(?:[^!\"\\(\\),/:-\\?\\[-\\]e\\{\\}]|e[^!\"\\(\\),/:-\\?\\[-\\]t\\{\\}]))))))[^!\"\\(\\),/:-\\?\\[-\\]\\{\\}]*[\\s\\x0b]*=[\\s\\x0b]*[^!\\(\\),/:-\\?\\[-\\]\\{\\}]+);?)*)*$",
           "targets": [
-            "headers"
+            "all"
           ],
-          "action": "score",
+          "action": "block",
           "score": 10,
           "severity": "critical",
           "category": "protocol",
@@ -413,7 +413,7 @@
           "name": "Attempted multipart/form-data bypass",
           "pattern": "['\";=\\x5c]",
           "targets": [
-            "all"
+            "filename"
           ],
           "action": "score",
           "score": 10,
@@ -434,7 +434,7 @@
           "name": "Illegal Accept-Encoding header",
           "pattern": "br|compress|deflate|(?:pack200-)?gzip|identity|\\*|^$|aes128gcm|exi|zstd|x-(?:compress|gzip)",
           "targets": [
-            "headers"
+            "all"
           ],
           "action": "score",
           "score": 10,
@@ -455,7 +455,7 @@
           "name": "Invalid character in request headers (outside of very strict set)",
           "pattern": "^(?:\\?[01])?$",
           "targets": [
-            "headers"
+            "all"
           ],
           "action": "score",
           "score": 10,
@@ -677,9 +677,9 @@
           "name": "Content-Type header: Dangerous content type outside the mime type declaration",
           "pattern": "^[^\\s\\x0b,;]+[\\s\\x0b,;].*?(?:application/(?:.+\\+)?json|(?:application/(?:soap\\+)?|text/)xml)",
           "targets": [
-            "headers"
+            "all"
           ],
-          "action": "score",
+          "action": "block",
           "score": 10,
           "severity": "critical",
           "category": "protocol",
@@ -740,7 +740,7 @@
           "name": "Content-Type header: Dangerous content type outside the mime type declaration",
           "pattern": "^[^\\s\\x0b,;]+[\\s\\x0b,;].*?\\b(?:((?:tex|multipar)t|application)|((?:audi|vide)o|image|cs[sv]|(?:vn|relate)d|p(?:df|lain)|json|(?:soa|cs)p|x(?:ml|-www-form-urlencoded)|form-data|x-amf|(?:octe|repor)t|stream)|([\\+/]))\\b",
           "targets": [
-            "headers"
+            "all"
           ],
           "action": "score",
           "score": 10,
@@ -1220,6 +1220,7 @@
           "name": "Remote Command Execution: Shellshock (CVE-2014-6271)",
           "pattern": "^(?:json\\.)?\\([\\s\\x0b]*\\)[\\s\\x0b]+\\{",
           "targets": [
+            "filename",
             "query"
           ],
           "action": "block",
@@ -1346,7 +1347,7 @@
           "name": "Remote Command Execution: Unix Shell Expression Found",
           "pattern": "\\$(?:\\((?:[^\\)]+|\\([^\\)]+\\))\\)|\\{[^\\}]+\\}|\\[[^\\]]*\\])|[<>]\\([^\\)]+\\)|/[0-9A-Z_a-z]*\\[[^\\]]+\\]",
           "targets": [
-            "headers"
+            "user_agent"
           ],
           "action": "score",
           "score": 10,
@@ -1535,7 +1536,7 @@
           "name": "Remote Command Execution: Unix Command Injection found in user-agent or referer header",
           "pattern": "(?i)(?:^(?:json\\.|\\x5c)?|b[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?u[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?s[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?y[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?b[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?o[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?x|(?:c[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?o[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?m[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?m[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?a[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?n[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?d|e[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?(?:n[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?v|v[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?a[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?l)|w[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?a[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?t[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?c[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?h)[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?[\"']?[\\s\\x0b&\\),<>\\|].*|[ls][\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?t[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?r[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?a[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?c[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?e|n[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?o[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?h[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?u[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?p|t[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?i[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?m[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?e[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?(?:[\"']?[\\s\\x0b&\\),<>\\|].*|o[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?u[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?t)|[\\n\\r;=`\\{]|\\|\\|?|&&?|\\$(?:\\(\\(?|[\\[\\{])|<(?:\\(|<<)|>\\(|\\([\\s\\x0b]*\\))[\\s\\x0b]*(?:[!\\$\\(\\{][\\s\\x0b]*|(?:[0-9A-Z_a-z]+=[^\\s\\x0b]+|\\$[0-9A-Z_a-z]+)[\\s\\x0b]+)*[\\s\\x0b]*[\"']*(?:[\"'-\\+\\--9\\?A-\\]_a-z\\|]+/)?[\"'\\x5c]*(?:(?:7z[arx]?|(?:GE|POS)T|y(?:e(?:s|lp)|um|arn)|HEAD)[\"']?[\\s\\x0b&\\),<>\\|]|a(?:a-[^\\s\\x0b]{1,10}\\b|(?:b|w[ks]|l(?:ias|pine)|tobm|xel)[\"']?[\\s\\x0b&\\),<>\\|]|p(?:t(?:[\"']?[\\s\\x0b&\\),<>\\|]|-get)|parmor_[^\\s\\x0b]{1,10}\\b)|r(?:(?:p|ch)?[\"']?[\\s\\x0b&\\),<>\\|]|j(?:[\"']?[\\s\\x0b&\\),<>\\|]|-register|disp)|ia2c)|s(?:h[\"']?[\\s\\x0b&\\),<>\\|]|cii(?:-xfr|85)|pell)|dd(?:group|user)|getty|nsible|u(?:ditctl|repot|search))|b(?:z(?:(?:z|c(?:at|mp))[\"']?[\\s\\x0b&\\),<>\\|]|diff|e(?:grep|xe[\"']?[\\s\\x0b&\\),<>\\|])|f?grep|ip2(?:[\"']?[\\s\\x0b&\\),<>\\|]|recover)|less|more)|a(?:s(?:e(?:32|64[\"']?[\\s\\x0b&\\),<>\\|]|n(?:ame[\"']?[\\s\\x0b&\\),<>\\|]|c))|h[\"']?[\\s\\x0b&\\),<>\\|])|tch[\"']?[\\s\\x0b&\\),<>\\|])|lkid[\"']?[\\s\\x0b&\\),<>\\|]|pftrace|r(?:eaksw|(?:idge|wap)[\"']?[\\s\\x0b&\\),<>\\|])|sd(?:cat|iff|tar)|u(?:iltin|n(?:dler[\"']?[\\s\\x0b&\\),<>\\|]|zip2)|s(?:ctl|ybox))|y(?:ebug|obu[\"']?[\\s\\x0b&\\),<>\\|]))|c(?:[89]9(?:[\"']?[\\s\\x0b&\\),<>\\|]|-gcc)|a(?:(?:t|ncel|psh)[\"']?[\\s\\x0b&\\),<>\\|]|rgo(?:-(?:audit|miri|watch)|[\"']?[\\s\\x0b&\\),<>\\|]))|(?:c|mp)[\"']?[\\s\\x0b&\\),<>\\|]|p(?:(?:an|io)?[\"']?[\\s\\x0b&\\),<>\\|]|ulimit)|s(?:(?:h|cli)[\"']?[\\s\\x0b&\\),<>\\|]|plit|vtool)|u(?:t[\"']?[\\s\\x0b&\\),<>\\|]|psfilter)|ertbot|h(?:(?:(?:att|di)r|mod|o(?:om|wn)|root|sh)[\"']?[\\s\\x0b&\\),<>\\|]|e(?:ck_(?:by_ssh|cups|log|memory|raid|s(?:sl_cert|tatusfile))|f(?:-|[\"']?[\\s\\x0b&\\),<>\\|]))|(?:flag|pas)s|g(?:passwd|rp[\"']?[\\s\\x0b&\\),<>\\|]))|l(?:ang(?:\\+\\+|[\"']?[\\s\\x0b&\\),<>\\|])|ippy-driver)|o(?:bc(?:[\"']?[\\s\\x0b&\\),<>\\|]|run)|(?:lumn|m(?:m(?:and)?|p(?:oser|ress)))[\"']?[\\s\\x0b&\\),<>\\|]|proc|w(?:say|think))|r(?:ash[\"']?[\\s\\x0b&\\),<>\\|]|on(?:[\"']?[\\s\\x0b&\\),<>\\|]|tab)))|d(?:(?:[dfu]|i(?:(?:alo)?g|r|ff)|a(?:sh|te)|vips)[\"']?[\\s\\x0b&\\),<>\\|]|hclient|m(?:esg[\"']?[\\s\\x0b&\\),<>\\|]|idecode|setup)|o(?:(?:as|ne)[\"']?[\\s\\x0b&\\),<>\\|]|cker(?:-|[\"']?[\\s\\x0b&\\),<>\\|])|sbox)|pkg(?:-|[\"']?[\\s\\x0b&\\),<>\\|]))|e(?:(?:[bd]|qn|s(?:h|ac)?|cho|fax|grep|macs|val)[\"']?[\\s\\x0b&\\),<>\\|]|n(?:v(?:[\"']?[\\s\\x0b&\\),<>\\|]|-update)|d(?:if|sw)[\"']?[\\s\\x0b&\\),<>\\|])|x(?:(?:ec|p(?:and|(?:ec|or)t|r))?[\"']?[\\s\\x0b&\\),<>\\|]|iftool)|2fsck|asy_install)|f(?:(?:c|g(?:rep)?|mt|etch|lock|unction)[\"']?[\\s\\x0b&\\),<>\\|]|i(?:(?:n(?:d|ger)|sh)?[\"']?[\\s\\x0b&\\),<>\\|]|le(?:[\"']?[\\s\\x0b&\\),<>\\|]|test))|tp(?:[\"']?[\\s\\x0b&\\),<>\\|]|stats|who)|acter|d(?:(?:find|isk)[\"']?[\\s\\x0b&\\),<>\\|]|u?mount)|o(?:ld[\"']?[\\s\\x0b&\\),<>\\|]|reach)|ping(?:6|[\"']?[\\s\\x0b&\\),<>\\|]))|g(?:c(?:c[^\\s\\x0b]{1,10}\\b|ore[\"']?[\\s\\x0b&\\),<>\\|])|(?:db|i(?:t|mp|nsh)|o|pg|awk|z(?:cat|exe|ip))[\"']?[\\s\\x0b&\\),<>\\|]|e(?:m[\"']?[\\s\\x0b&\\),<>\\|]|ni(?:e[\"']?[\\s\\x0b&\\),<>\\|]|soimage)|t(?:cap|facl[\"']?[\\s\\x0b&\\),<>\\|]))|hc(?:-?[\"']?[\\s\\x0b&\\),<>\\|]|i(?:-|[\"']?[\\s\\x0b&\\),<>\\|]))|r(?:(?:c(?:at)?|ep)[\"']?[\\s\\x0b&\\),<>\\|]|oupmod)|tester|unzip)|h(?:(?:d|up|ash|i(?:ghlight|story))[\"']?[\\s\\x0b&\\),<>\\|]|e(?:ad[\"']?[\\s\\x0b&\\),<>\\|]|xdump)|ost(?:id|name)|ping3|t(?:digest|op[\"']?[\\s\\x0b&\\),<>\\|]|passwd))|i(?:(?:d|rb|conv|nstall)[\"']?[\\s\\x0b&\\),<>\\|]|p(?:[\"']?[\\s\\x0b&\\),<>\\|]|6?tables|config|p(?:eveprinter|find|tool))|f(?:config|top[\"']?[\\s\\x0b&\\),<>\\|])|onice|spell)|j(?:(?:js|q|ava|exec)[\"']?[\\s\\x0b&\\),<>\\|]|o(?:(?:bs|in)[\"']?[\\s\\x0b&\\),<>\\|]|urnalctl)|runscript)|k(?:s(?:h[\"']?[\\s\\x0b&\\),<>\\|]|shell)|ill(?:[\"']?[\\s\\x0b&\\),<>\\|]|all)|nife[\"']?[\\s\\x0b&\\),<>\\|])|l(?:(?:a(?:st(?:comm|log(?:in)?)?|tex)?|[lnp]|ynx)?[\"']?[\\s\\x0b&\\),<>\\|]|d(?:d?[\"']?[\\s\\x0b&\\),<>\\|]|config)|s(?:(?:-F|cpu|hw|mod|of|pci|usb)?[\"']?[\\s\\x0b&\\),<>\\|]|b_release)|ua(?:[\"']?[\\s\\x0b&\\),<>\\|]|(?:la)?tex)|z(?:4(?:[\"']?[\\s\\x0b&\\),<>\\|]|c(?:[\"']?[\\s\\x0b&\\),<>\\|]|at))|(?:c(?:at|mp))?[\"']?[\\s\\x0b&\\),<>\\|]|diff|[ef]?grep|less|m(?:a(?:[\"']?[\\s\\x0b&\\),<>\\|]|dec|info)|ore))|ess(?:[\"']?[\\s\\x0b&\\),<>\\|]|echo|(?:fil|pip)e)|ftp(?:[\"']?[\\s\\x0b&\\),<>\\|]|get)|o(?:(?:ca(?:l|te)|ok)[\"']?[\\s\\x0b&\\),<>\\|]|g(?:inctl|(?:nam|sav)e)|setup)|trace|wp-(?:d(?:ownload|ump)|mirror|request))|m(?:(?:a(?:n|il[qx]?|ke|wk)|tr|v|utt)[\"']?[\\s\\x0b&\\),<>\\|]|k(?:(?:dir|nod)[\"']?[\\s\\x0b&\\),<>\\|]|fifo|temp)|locate|o(?:squitto|unt[\"']?[\\s\\x0b&\\),<>\\|])|sg(?:attrib|c(?:at|onv)|filter|merge|uniq)|ysql(?:[\"']?[\\s\\x0b&\\),<>\\|]|admin|dump(?:slow)?|hotcopy|show))|n(?:c(?:(?:at)?[\"']?[\\s\\x0b&\\),<>\\|]|\\.(?:openbsd|traditional))|e(?:t(?:[\"']?[\\s\\x0b&\\),<>\\|]|(?:c|st)at|kit-ftp|plan)|ofetch)|(?:l|m(?:ap)?|p(?:m|ing)|a(?:no|sm|wk)|ice|o(?:de|hup)|roff)[\"']?[\\s\\x0b&\\),<>\\|]|s(?:enter|lookup|tat[\"']?[\\s\\x0b&\\),<>\\|]))|o(?:(?:d|ctave)[\"']?[\\s\\x0b&\\),<>\\|]|nintr|p(?:en(?:ssl|v(?:pn|t))|kg[\"']?[\\s\\x0b&\\),<>\\|]))|p(?:a(?:(?:x|rted|tch)[\"']?[\\s\\x0b&\\),<>\\|]|s(?:swd|te[\"']?[\\s\\x0b&\\),<>\\|]))|d(?:b(?:[\"']?[\\s\\x0b&\\),<>\\|]|2mb|3(?:\\.|[\"']?[\\s\\x0b&\\),<>\\|]))|f(?:la)?tex|ksh[\"']?[\\s\\x0b&\\),<>\\|])|(?:f(?:tp)?|g(?:rep)?|(?:w|op)d|xz|u(?:ppet|shd))[\"']?[\\s\\x0b&\\),<>\\|]|hp(?:[57]?[\"']?[\\s\\x0b&\\),<>\\|]|-cgi)|i(?:c(?:[\"']?[\\s\\x0b&\\),<>\\|]|o(?:[\"']?[\\s\\x0b&\\),<>\\|]|nv))|p(?:[\"']?[\\s\\x0b&\\),<>\\|]|[^\\s\\x0b]{1,10}\\b)|dstat|(?:gz|ng6?)[\"']?[\\s\\x0b&\\),<>\\|])|k(?:g(?:[\"']?[\\s\\x0b&\\),<>\\|]|_?info)|exec|ill[\"']?[\\s\\x0b&\\),<>\\|])|r(?:y?[\"']?[\\s\\x0b&\\),<>\\|]|int(?:env|f[\"']?[\\s\\x0b&\\),<>\\|]))|t(?:x[\"']?[\\s\\x0b&\\),<>\\|]|ar(?:[\"']?[\\s\\x0b&\\),<>\\|]|diff|grep))|er(?:(?:f|ms)[\"']?[\\s\\x0b&\\),<>\\|]|l(?:5?[\"']?[\\s\\x0b&\\),<>\\|]|sh))|s(?:(?:ed|ql)[\"']?[\\s\\x0b&\\),<>\\|]|ftp)|y(?:3?versions|thon[23]))|r(?:(?:a(?:r|k[eu])|cp?|bash|nano|oute|vi(?:ew|m))[\"']?[\\s\\x0b&\\),<>\\|]|e(?:(?:d(?:carpet)?|v|boot|name|p(?:eat|lace))[\"']?[\\s\\x0b&\\),<>\\|]|a(?:delf|lpath)|stic)|m(?:(?:dir)?[\"']?[\\s\\x0b&\\),<>\\|]|t(?:[\"']?[\\s\\x0b&\\),<>\\|]|-(?:dump|tar))|user)|pm(?:(?:db)?[\"']?[\\s\\x0b&\\),<>\\|]|(?:quer|verif)y)|l(?:ogin|wrap)|sync(?:-ssl|[\"']?[\\s\\x0b&\\),<>\\|])|u(?:by[^\\s\\x0b]{1,10}\\b|n(?:-(?:mailcap|parts)|c[\"']?[\\s\\x0b&\\),<>\\|])|st(?:-(?:analyzer|(?:g|ll)db)|c[\"']?[\\s\\x0b&\\),<>\\|]|doc|fmt|up)))|s(?:(?:c(?:p|hed|r(?:een|ipt))|g|ash|diff|ftp|l(?:eep|sh)|plit)[\"']?[\\s\\x0b&\\),<>\\|]|e(?:(?:d|ndmail|rvice)[\"']?[\\s\\x0b&\\),<>\\|]|t(?:(?:facl)?[\"']?[\\s\\x0b&\\),<>\\|]|arch|cap|env|sid))|h(?:(?:red|u(?:f|tdown))?[\"']?[\\s\\x0b&\\),<>\\|]|\\.distrib)|s(?:[\"']?[\\s\\x0b&\\),<>\\|]|h(?:[\"']?[\\s\\x0b&\\),<>\\|]|-(?:a(?:dd|gent)|copy-id|key(?:ge|sca)n)|pass))|u(?:[\"']?[\\s\\x0b&\\),<>\\|]|do(?:-rs|[\"']?[\\s\\x0b&\\),<>\\|]|_|edit|replay))|vn(?:[\"']?[\\s\\x0b&\\),<>\\|]|a(?:dmin|uthz)|bench|dumpfilter|fsfs|look|mucc|rdump|s(?:erve|ync)|version)|mbclient|o(?:(?:(?:ca|r)t|urce)[\"']?[\\s\\x0b&\\),<>\\|]|elim)|qlite3|t(?:a(?:rt-stop-daemon|t[\"']?[\\s\\x0b&\\),<>\\|])|dbuf|r(?:ace|ings[\"']?[\\s\\x0b&\\),<>\\|]))|ys(?:ctl|tem(?:ctl|d-resolve)))|t(?:a(?:(?:[cr]|ilf?)[\"']?[\\s\\x0b&\\),<>\\|]|sk(?:[\"']?[\\s\\x0b&\\),<>\\|]|set))|(?:bl|o(?:p|uch)|ftp|mux)[\"']?[\\s\\x0b&\\),<>\\|]|e(?:[ex][\"']?[\\s\\x0b&\\),<>\\|]|lnet)|i(?:c[\"']?[\\s\\x0b&\\),<>\\|]|me(?:datectl|out[\"']?[\\s\\x0b&\\),<>\\|]))|c(?:l?sh[\"']?[\\s\\x0b&\\),<>\\|]|p(?:dump|ing|traceroute))|r(?:a(?:ceroute6?|p[\"']?[\\s\\x0b&\\),<>\\|])|off[\"']?[\\s\\x0b&\\),<>\\|])|shark)|u(?:(?:l(?:imit)?|conv)[\"']?[\\s\\x0b&\\),<>\\|]|n(?:(?:ame|compress|iq|rar|s(?:et|hare)|xz)[\"']?[\\s\\x0b&\\),<>\\|]|expand|l(?:ink[\"']?[\\s\\x0b&\\),<>\\|]|z(?:4[\"']?[\\s\\x0b&\\),<>\\|]|ma))|pigz|z(?:ip[\"']?[\\s\\x0b&\\),<>\\|]|std))|pdate-alternatives|ser(?:(?:ad|mo)d|del)|u(?:de|en)code)|v(?:i(?:m(?:[\"']?[\\s\\x0b&\\),<>\\|]|diff)|(?:[ep]w|gr|rsh)[\"']?[\\s\\x0b&\\),<>\\|]|sudo(?:-rs)?)|algrind|olatility[\"']?[\\s\\x0b&\\),<>\\|])|w(?:(?:c|a(?:ll|tch))[\"']?[\\s\\x0b&\\),<>\\|]|h(?:iptail[\"']?[\\s\\x0b&\\),<>\\|]|o(?:ami|is[\"']?[\\s\\x0b&\\),<>\\|]))|i(?:reshark|sh[\"']?[\\s\\x0b&\\),<>\\|]))|x(?:(?:(?:x|pa)d|args|term)[\"']?[\\s\\x0b&\\),<>\\|]|z(?:(?:c(?:at|mp))?[\"']?[\\s\\x0b&\\),<>\\|]|d(?:ec[\"']?[\\s\\x0b&\\),<>\\|]|iff)|[ef]?grep|less|more)|e(?:latex|tex[\"']?[\\s\\x0b&\\),<>\\|])|mo(?:dmap|re[\"']?[\\s\\x0b&\\),<>\\|]))|z(?:ip(?:[\"']?[\\s\\x0b&\\),<>\\|]|c(?:loak|mp)|details|grep|info|(?:merg|not)e|split|tool)|s(?:h[\"']?[\\s\\x0b&\\),<>\\|]|oelim|td(?:[\"']?[\\s\\x0b&\\),<>\\|]|(?:ca|m)t|grep|less))|athura|(?:c(?:at|mp)|diff|grep|less|run)[\"']?[\\s\\x0b&\\),<>\\|]|[ef]grep|mo(?:dload|re[\"']?[\\s\\x0b&\\),<>\\|])|ypper))",
           "targets": [
-            "headers"
+            "user_agent"
           ],
           "action": "score",
           "score": 10,
@@ -1598,7 +1599,7 @@
           "name": "Remote Command Execution: Unix Shell Code Found in REQUEST_HEADERS",
           "pattern": "(?i)\\b(?:(?:7z[arx]?|(?:GE|POS)T|y(?:e(?:s|lp)|um|arn)|HEAD)[\"']?[\\s\\x0b&\\),<>\\|]|a(?:a-[^\\s\\x0b]{1,10}\\b|(?:b|t(?:obm)?|w[ks]|l(?:ias|pine)|xel)[\"']?[\\s\\x0b&\\),<>\\|]|p(?:t(?:(?:itude)?[\"']?[\\s\\x0b&\\),<>\\|]|-get)|parmor_[^\\s\\x0b]{1,10}\\b)|r(?:(?:p|ch)?[\"']?[\\s\\x0b&\\),<>\\|]|j(?:[\"']?[\\s\\x0b&\\),<>\\|]|-register|disp)|ia2c)|s(?:h?[\"']?[\\s\\x0b&\\),<>\\|]|cii(?:-xfr|85)|pell)|dd(?:group|user)|getty|nsible|u(?:ditctl|repot|search))|b(?:z(?:(?:z|c(?:at|mp))[\"']?[\\s\\x0b&\\),<>\\|]|diff|e(?:grep|xe[\"']?[\\s\\x0b&\\),<>\\|])|f?grep|ip2(?:[\"']?[\\s\\x0b&\\),<>\\|]|recover)|less|more)|a(?:s(?:e(?:32|64[\"']?[\\s\\x0b&\\),<>\\|]|n(?:ame[\"']?[\\s\\x0b&\\),<>\\|]|c))|h[\"']?[\\s\\x0b&\\),<>\\|])|tch[\"']?[\\s\\x0b&\\),<>\\|])|lkid[\"']?[\\s\\x0b&\\),<>\\|]|pftrace|r(?:eaksw|(?:idge|wap)[\"']?[\\s\\x0b&\\),<>\\|])|sd(?:cat|iff|tar)|u(?:iltin|n(?:dler[\"']?[\\s\\x0b&\\),<>\\|]|zip2)|s(?:ctl|ybox))|y(?:ebug|obu[\"']?[\\s\\x0b&\\),<>\\|]))|c(?:[89]9(?:[\"']?[\\s\\x0b&\\),<>\\|]|-gcc)|a(?:(?:t|ncel|psh)[\"']?[\\s\\x0b&\\),<>\\|]|rgo(?:-(?:audit|miri|watch)|[\"']?[\\s\\x0b&\\),<>\\|]))|(?:c|mp)[\"']?[\\s\\x0b&\\),<>\\|]|p(?:(?:an|io)?[\"']?[\\s\\x0b&\\),<>\\|]|ulimit)|s(?:(?:h|cli)[\"']?[\\s\\x0b&\\),<>\\|]|plit|vtool)|u(?:t[\"']?[\\s\\x0b&\\),<>\\|]|psfilter)|ertbot|h(?:(?:(?:att|di)r|mod|o(?:om|wn)|root|sh)[\"']?[\\s\\x0b&\\),<>\\|]|e(?:ck_(?:by_ssh|cups|log|memory|raid|s(?:sl_cert|tatusfile))|f(?:-|[\"']?[\\s\\x0b&\\),<>\\|]))|(?:flag|pas)s|g(?:passwd|rp[\"']?[\\s\\x0b&\\),<>\\|]))|l(?:ang(?:\\+\\+|[\"']?[\\s\\x0b&\\),<>\\|])|ippy-driver)|o(?:bc(?:[\"']?[\\s\\x0b&\\),<>\\|]|run)|(?:lumn|m(?:m(?:and)?|p(?:oser|ress)))[\"']?[\\s\\x0b&\\),<>\\|]|proc|w(?:say|think))|r(?:ash[\"']?[\\s\\x0b&\\),<>\\|]|on(?:[\"']?[\\s\\x0b&\\),<>\\|]|tab)))|d(?:(?:[dfu]|i(?:(?:alo)?g|r|ff)|a(?:sh|te)|vips)[\"']?[\\s\\x0b&\\),<>\\|]|nf(?:[\"']?[\\s\\x0b&\\),<>\\|])?|hclient|m(?:esg[\"']?[\\s\\x0b&\\),<>\\|]|idecode|setup)|o(?:(?:as|ne)[\"']?[\\s\\x0b&\\),<>\\|]|cker(?:-|[\"']?[\\s\\x0b&\\),<>\\|])|sbox)|pkg(?:-|[\"']?[\\s\\x0b&\\),<>\\|]))|e(?:(?:[bd]|qn|s(?:h|ac)?|cho|fax|grep|macs|val)[\"']?[\\s\\x0b&\\),<>\\|]|n(?:v(?:[\"']?[\\s\\x0b&\\),<>\\|]|-update)|d(?:if|sw)[\"']?[\\s\\x0b&\\),<>\\|])|x(?:(?:ec|p(?:and|(?:ec|or)t|r))?[\"']?[\\s\\x0b&\\),<>\\|]|iftool)|2fsck|asy_install)|f(?:(?:c|g(?:rep)?|mt|etch|lock|unction)[\"']?[\\s\\x0b&\\),<>\\|]|i(?:(?:n(?:d|ger)|sh)?[\"']?[\\s\\x0b&\\),<>\\|]|le(?:[\"']?[\\s\\x0b&\\),<>\\|]|test))|tp(?:[\"']?[\\s\\x0b&\\),<>\\|]|stats|who)|acter|d(?:(?:find|isk)[\"']?[\\s\\x0b&\\),<>\\|]|u?mount)|o(?:ld[\"']?[\\s\\x0b&\\),<>\\|]|reach)|ping(?:6|[\"']?[\\s\\x0b&\\),<>\\|]))|g(?:c(?:c[^\\s\\x0b]{1,10}\\b|ore[\"']?[\\s\\x0b&\\),<>\\|])|(?:db|i(?:t|mp|nsh)|o|pg|awk|z(?:cat|exe|ip))[\"']?[\\s\\x0b&\\),<>\\|]|e(?:m[\"']?[\\s\\x0b&\\),<>\\|]|ni(?:e[\"']?[\\s\\x0b&\\),<>\\|]|soimage)|t(?:cap|facl[\"']?[\\s\\x0b&\\),<>\\|]))|hc(?:-?[\"']?[\\s\\x0b&\\),<>\\|]|i(?:-|[\"']?[\\s\\x0b&\\),<>\\|]))|r(?:(?:c(?:at)?|ep)[\"']?[\\s\\x0b&\\),<>\\|]|oupmod)|tester|unzip)|h(?:(?:d|up|ash|i(?:ghlight|story))[\"']?[\\s\\x0b&\\),<>\\|]|e(?:ad[\"']?[\\s\\x0b&\\),<>\\|]|xdump)|ost(?:id|name)|ping3|t(?:digest|op[\"']?[\\s\\x0b&\\),<>\\|]|passwd))|i(?:(?:d|rb|conv|nstall)[\"']?[\\s\\x0b&\\),<>\\|]|p(?:[\"']?[\\s\\x0b&\\),<>\\|]|6?tables|config|p(?:eveprinter|find|tool))|f(?:config|top[\"']?[\\s\\x0b&\\),<>\\|])|onice|spell)|j(?:(?:js|q|ava|exec)[\"']?[\\s\\x0b&\\),<>\\|]|o(?:(?:bs|in)[\"']?[\\s\\x0b&\\),<>\\|]|urnalctl)|runscript)|k(?:s(?:h[\"']?[\\s\\x0b&\\),<>\\|]|shell)|ill(?:[\"']?[\\s\\x0b&\\),<>\\|]|all)|nife[\"']?[\\s\\x0b&\\),<>\\|])|l(?:(?:a(?:st(?:comm|log(?:in)?)?|tex)?|[lnp]|ynx)?[\"']?[\\s\\x0b&\\),<>\\|]|d(?:d?[\"']?[\\s\\x0b&\\),<>\\|]|config)|s(?:(?:-F|cpu|hw|mod|of|pci|usb)?[\"']?[\\s\\x0b&\\),<>\\|]|b_release)|ua(?:[\"']?[\\s\\x0b&\\),<>\\|]|(?:la)?tex)|z(?:4(?:[\"']?[\\s\\x0b&\\),<>\\|]|c(?:[\"']?[\\s\\x0b&\\),<>\\|]|at))|(?:c(?:at|mp))?[\"']?[\\s\\x0b&\\),<>\\|]|diff|[ef]?grep|less|m(?:a(?:[\"']?[\\s\\x0b&\\),<>\\|]|dec|info)|ore))|ess(?:[\"']?[\\s\\x0b&\\),<>\\|]|echo|(?:fil|pip)e)|ftp(?:[\"']?[\\s\\x0b&\\),<>\\|]|get)|o(?:(?:ca(?:l|te)|ok)[\"']?[\\s\\x0b&\\),<>\\|]|g(?:inctl|(?:nam|sav)e)|setup)|trace|wp-(?:d(?:ownload|ump)|mirror|request))|m(?:(?:a(?:n|il[qx]?|ke|wk)|tr|v|utt)[\"']?[\\s\\x0b&\\),<>\\|]|k(?:(?:dir|nod)[\"']?[\\s\\x0b&\\),<>\\|]|fifo|temp)|locate|o(?:(?:re|unt)[\"']?[\\s\\x0b&\\),<>\\|]|squitto)|sg(?:attrib|c(?:at|onv)|filter|merge|uniq)|ysql(?:[\"']?[\\s\\x0b&\\),<>\\|]|admin|dump(?:slow)?|hotcopy|show))|n(?:c(?:(?:at)?[\"']?[\\s\\x0b&\\),<>\\|]|\\.(?:openbsd|traditional))|e(?:t(?:[\"']?[\\s\\x0b&\\),<>\\|]|(?:c|st)at|kit-ftp|plan)|ofetch)|(?:l|m(?:ap)?|p(?:m|ing)|a(?:no|sm|wk)|ice|o(?:de|hup)|roff)[\"']?[\\s\\x0b&\\),<>\\|]|s(?:enter|lookup|tat[\"']?[\\s\\x0b&\\),<>\\|]))|o(?:(?:d|ctave)[\"']?[\\s\\x0b&\\),<>\\|]|nintr|p(?:en(?:ssl|v(?:pn|t))|kg[\"']?[\\s\\x0b&\\),<>\\|]))|p(?:a(?:(?:x|cman|rted|tch)[\"']?[\\s\\x0b&\\),<>\\|]|s(?:swd|te[\"']?[\\s\\x0b&\\),<>\\|]))|d(?:b(?:[\"']?[\\s\\x0b&\\),<>\\|]|2mb|3(?:\\.|[\"']?[\\s\\x0b&\\),<>\\|]))|f(?:la)?tex|ksh[\"']?[\\s\\x0b&\\),<>\\|])|(?:f(?:tp)?|g(?:rep)?|(?:w|op)d|xz|u(?:ppet|shd))[\"']?[\\s\\x0b&\\),<>\\|]|hp(?:[57]?[\"']?[\\s\\x0b&\\),<>\\|]|-cgi)|i(?:c(?:[\"']?[\\s\\x0b&\\),<>\\|]|o(?:[\"']?[\\s\\x0b&\\),<>\\|]|nv))|p(?:[\"']?[\\s\\x0b&\\),<>\\|]|[^\\s\\x0b]{1,10}\\b)|dstat|(?:gz|ng6?)[\"']?[\\s\\x0b&\\),<>\\|])|k(?:g(?:[\"']?[\\s\\x0b&\\),<>\\|]|_?info)|exec|ill[\"']?[\\s\\x0b&\\),<>\\|])|r(?:y?[\"']?[\\s\\x0b&\\),<>\\|]|int(?:env|f[\"']?[\\s\\x0b&\\),<>\\|]))|s(?:(?:ed|ql)?[\"']?[\\s\\x0b&\\),<>\\|]|ftp)|t(?:x[\"']?[\\s\\x0b&\\),<>\\|]|ar(?:[\"']?[\\s\\x0b&\\),<>\\|]|diff|grep))|er(?:(?:f|ms)[\"']?[\\s\\x0b&\\),<>\\|]|l(?:5?[\"']?[\\s\\x0b&\\),<>\\|]|sh))|y(?:3?versions|thon[23]))|r(?:(?:a(?:r|k[eu])|cp?|bash|nano|oute|vi(?:ew|m))[\"']?[\\s\\x0b&\\),<>\\|]|e(?:(?:d(?:carpet)?|v|boot|name|p(?:eat|lace))[\"']?[\\s\\x0b&\\),<>\\|]|a(?:delf|lpath)|stic)|m(?:(?:dir)?[\"']?[\\s\\x0b&\\),<>\\|]|t(?:[\"']?[\\s\\x0b&\\),<>\\|]|-(?:dump|tar))|user)|pm(?:(?:db)?[\"']?[\\s\\x0b&\\),<>\\|]|(?:quer|verif)y)|l(?:ogin|wrap)|sync(?:-ssl|[\"']?[\\s\\x0b&\\),<>\\|])|u(?:by[^\\s\\x0b]{1,10}\\b|n(?:-(?:mailcap|parts)|c[\"']?[\\s\\x0b&\\),<>\\|])|st(?:-(?:analyzer|(?:g|ll)db)|c[\"']?[\\s\\x0b&\\),<>\\|]|doc|fmt|up)))|s(?:(?:c(?:p|hed|r(?:een|ipt))|g|ash|diff|ftp|l(?:eep|sh)|plit)[\"']?[\\s\\x0b&\\),<>\\|]|e(?:(?:d|ndmail|rvice)[\"']?[\\s\\x0b&\\),<>\\|]|t(?:(?:facl)?[\"']?[\\s\\x0b&\\),<>\\|]|arch|cap|env|sid))|h(?:(?:red|u(?:f|tdown))?[\"']?[\\s\\x0b&\\),<>\\|]|\\.distrib)|s(?:[\"']?[\\s\\x0b&\\),<>\\|]|h(?:[\"']?[\\s\\x0b&\\),<>\\|]|-(?:a(?:dd|gent)|copy-id|key(?:ge|sca)n)|pass))|u(?:[\"']?[\\s\\x0b&\\),<>\\|]|do(?:-rs|[\"']?[\\s\\x0b&\\),<>\\|]|_|edit|replay))|vn(?:[\"']?[\\s\\x0b&\\),<>\\|]|a(?:dmin|uthz)|bench|dumpfilter|fsfs|look|mucc|rdump|s(?:erve|ync)|version)|mbclient|o(?:(?:(?:ca|r)t|urce)[\"']?[\\s\\x0b&\\),<>\\|]|elim)|qlite3|t(?:a(?:rt-stop-daemon|t[\"']?[\\s\\x0b&\\),<>\\|])|dbuf|r(?:ace|ings[\"']?[\\s\\x0b&\\),<>\\|]))|ys(?:ctl|tem(?:ctl|d-resolve)))|t(?:a(?:(?:[cr]|ilf?)[\"']?[\\s\\x0b&\\),<>\\|]|sk(?:[\"']?[\\s\\x0b&\\),<>\\|]|set))|(?:bl|o(?:p|uch)|ftp|mux)[\"']?[\\s\\x0b&\\),<>\\|]|e(?:[ex][\"']?[\\s\\x0b&\\),<>\\|]|lnet)|i(?:c[\"']?[\\s\\x0b&\\),<>\\|]|me(?:(?:out)?[\"']?[\\s\\x0b&\\),<>\\|]|datectl))|c(?:l?sh[\"']?[\\s\\x0b&\\),<>\\|]|p(?:dump|ing|traceroute))|r(?:a(?:ceroute6?|p[\"']?[\\s\\x0b&\\),<>\\|])|off[\"']?[\\s\\x0b&\\),<>\\|])|shark)|u(?:(?:l(?:imit)?|conv)[\"']?[\\s\\x0b&\\),<>\\|]|n(?:(?:ame|compress|iq|rar|s(?:et|hare)|xz)[\"']?[\\s\\x0b&\\),<>\\|]|expand|l(?:ink[\"']?[\\s\\x0b&\\),<>\\|]|z(?:4[\"']?[\\s\\x0b&\\),<>\\|]|ma))|pigz|z(?:ip[\"']?[\\s\\x0b&\\),<>\\|]|std))|p(?:2date[\"']?[\\s\\x0b&\\),<>\\|]|date-alternatives)|ser(?:(?:ad|mo)d|del)|u(?:de|en)code)|v(?:i(?:(?:[ep]w|gr|rsh)?[\"']?[\\s\\x0b&\\),<>\\|]|m(?:[\"']?[\\s\\x0b&\\),<>\\|]|diff)|sudo(?:-rs)?)|algrind|olatility[\"']?[\\s\\x0b&\\),<>\\|])|w(?:(?:c|a(?:ll|tch))?[\"']?[\\s\\x0b&\\),<>\\|]|h(?:o(?:(?:is)?[\"']?[\\s\\x0b&\\),<>\\|]|ami)?|iptail[\"']?[\\s\\x0b&\\),<>\\|])|i(?:reshark|sh[\"']?[\\s\\x0b&\\),<>\\|]))|x(?:(?:(?:x|pa)d|args|term)[\"']?[\\s\\x0b&\\),<>\\|]|z(?:(?:c(?:at|mp))?[\"']?[\\s\\x0b&\\),<>\\|]|d(?:ec[\"']?[\\s\\x0b&\\),<>\\|]|iff)|[ef]?grep|less|more)|e(?:latex|tex[\"']?[\\s\\x0b&\\),<>\\|])|mo(?:dmap|re[\"']?[\\s\\x0b&\\),<>\\|]))|z(?:ip(?:[\"']?[\\s\\x0b&\\),<>\\|]|c(?:loak|mp)|details|grep|info|(?:merg|not)e|split|tool)|s(?:h[\"']?[\\s\\x0b&\\),<>\\|]|oelim|td(?:[\"']?[\\s\\x0b&\\),<>\\|]|(?:ca|m)t|grep|less))|athura|(?:c(?:at|mp)|diff|grep|less|run)[\"']?[\\s\\x0b&\\),<>\\|]|[ef]grep|mo(?:dload|re[\"']?[\\s\\x0b&\\),<>\\|])|ypper))(?:\\b|[^0-9A-Z_a-z])",
           "targets": [
-            "headers"
+            "user_agent"
           ],
           "action": "score",
           "score": 10,
@@ -1820,9 +1821,9 @@
           "name": "PHP Injection Attack: PHP Script File Upload Found",
           "pattern": ".*\\.ph(?:p\\d*|tml|ar|ps|t|pt)\\.*$",
           "targets": [
-            "headers"
+            "filename"
           ],
-          "action": "score",
+          "action": "block",
           "score": 10,
           "severity": "critical",
           "category": "rce",
@@ -2009,9 +2010,9 @@
           "name": "PHP Injection Attack: PHP Session File Upload Attempt",
           "pattern": "(?:^|[/\\x5c])sess_[,\\-0-9a-z]{20,256}$",
           "targets": [
-            "headers"
+            "filename"
           ],
-          "action": "score",
+          "action": "block",
           "score": 10,
           "severity": "critical",
           "category": "rce",
@@ -2135,7 +2136,7 @@
           "name": "PHP Injection Attack: PHP Script File Upload Found",
           "pattern": ".*\\.ph(?:p\\d*|tml|ar|ps|t|pt)\\..*$",
           "targets": [
-            "headers"
+            "filename"
           ],
           "action": "score",
           "score": 10,
@@ -2967,7 +2968,6 @@
           "name": "XSS Attack Detected via libinjection",
           "pattern": "@detectXSS",
           "targets": [
-            "headers",
             "uri"
           ],
           "action": "score",
@@ -4032,7 +4032,7 @@
           "name": "SQL Injection Attack: SQL function name detected",
           "pattern": "(?i)\\b(?:a(?:dd(?:dat|tim)e|es_(?:de|en)crypt|s(?:cii(?:str)?|in)|tan2?)|b(?:enchmark|i(?:n_to_num|t_(?:and|count|length|x?or)))|c(?:har(?:acter)?_length|eil(?:ing)?|o(?:alesce|ercibility|llation|(?:mpres)?s|n(?:cat(?:_ws)?|nection_id|v(?:ert(?:_tz)?)?)|t)|rc32|ur(?:(?:dat|tim)e|rent_(?:date|setting|time(?:stamp)?|user)))|d(?:a(?:t(?:abase(?:_to_xml)?|e(?:_(?:add|format|sub)|diff))|y(?:name|of(?:month|week|year)))|count|e(?:code|grees|s_(?:de|en)crypt)|ump)|e(?:lt|n(?:c(?:ode|rypt)|ds_?with)|x(?:p(?:ort_set)?|tract(?:value)?))|f(?:i(?:el|n)d_in_set|ound_rows|rom_(?:base64|days|unixtime))|g(?:e(?:ometrycollection|t(?:_(?:format|lock)|pgusername))|(?:r(?:eates|oup_conca)|tid_subse)t)|hex(?:toraw)?|i(?:fnull|n(?:et6?_(?:aton|ntoa)|s(?:ert|tr)|terval)|s(?:_(?:(?:free|used)_lock|ipv(?:4(?:_(?:compat|mapped))?|6)|n(?:ot(?:_null)?|ull)|superuser)|null))|json(?:_(?:a(?:gg|rray(?:_(?:elements(?:_text)?|length))?)|build_(?:array|object)|e(?:ac|xtract_pat)h(?:_text)?|object(?:_(?:agg|keys))?|populate_record(?:set)?|strip_nulls|t(?:o_record(?:set)?|ypeof))|b(?:_(?:array(?:_(?:elements(?:_text)?|length))?|build_(?:array|object)|object(?:_(?:agg|keys))?|e(?:ac|xtract_pat)h(?:_text)?|insert|p(?:ath_(?:(?:exists|match)(?:_tz)?|query(?:_(?:(?:array|first)(?:_tz)?|tz))?)|opulate_record(?:set)?|retty)|s(?:et(?:_lax)?|trip_nulls)|t(?:o_record(?:set)?|ypeof)))?|path)?|l(?:ast_(?:day|insert_id)|case|e(?:as|f)t|i(?:kel(?:ihood|y)|nestring)|o(?:_(?:from_bytea|put)|ad_file|ca(?:ltimestamp|te)|g(?:10|2)|wer)|pad|trim)|m(?:a(?:ke(?:_set|date)|ster_pos_wait)|d5|i(?:crosecon)?d|onthname|ulti(?:linestring|po(?:int|lygon)))|n(?:ame_const|ot_in|ullif)|o(?:ct(?:et_length)?|(?:ld_passwo)?rd)|p(?:eriod_(?:add|diff)|g_(?:client_encoding|(?:databas|read_fil)e|l(?:argeobject|s_dir)|sleep|user)|o(?:(?:lyg|siti)on|w)|rocedure_analyse)|qu(?:arter|ery_to_xml|ote)|r(?:a(?:dians|nd|wtohex)|elease_lock|ow_(?:count|to_json)|pad|trim)|s(?:chema|e(?:c_to_time|ssion_user)|ha[12]?|in|oundex|pace|q(?:lite_(?:compileoption_(?:get|used)|source_id)|rt)|t(?:arts_?with|d(?:dev_(?:po|sam)p)?|r(?:_to_date|cmp))|ub(?:(?:dat|tim)e|str(?:ing(?:_index)?)?)|ys(?:date|tem_user))|t(?:ime(?:_(?:format|to_sec)|diff|stamp(?:add|diff)?)|o(?:_(?:base64|jsonb?)|n?char|(?:day|second)s)|r(?:im|uncate))|u(?:case|n(?:compress(?:ed_length)?|hex|i(?:str|x_timestamp)|likely)|(?:pdatexm|se_json_nul)l|tc_(?:date|time(?:stamp)?)|uid(?:_short)?)|var(?:_(?:po|sam)p|iance)|we(?:ek(?:day|ofyear)|ight_string)|xmltype|yearweek)[^0-9A-Z_a-z]*\\(",
           "targets": [
-            "headers"
+            "user_agent"
           ],
           "action": "score",
           "score": 10,
@@ -4053,7 +4053,7 @@
           "name": "Detects MySQL and PostgreSQL stored procedure/function injections",
           "pattern": "(?i)create[\\s\\x0b]+(?:function|procedure)[\\s\\x0b]*?[0-9A-Z_a-z]+[\\s\\x0b]*?\\([\\s\\x0b]*?\\)[\\s\\x0b]*?-|d(?:eclare[^0-9A-Z_a-z]+[#@][\\s\\x0b]*?[0-9A-Z_a-z]+|iv[\\s\\x0b]*?\\([\\+\\-]*[\\s\\x0b\\.0-9]+,[\\+\\-]*[\\s\\x0b\\.0-9]+\\))|exec[\\s\\x0b]*?\\([\\s\\x0b]*?@|(?:lo_(?:impor|ge)t|procedure[\\s\\x0b]+analyse)[\\s\\x0b]*?\\(|;[\\s\\x0b]*?(?:declare|open)[\\s\\x0b]+[\\-0-9A-Z_a-z]+|::(?:b(?:igint|ool)|double[\\s\\x0b]+precision|int(?:eger)?|numeric|oid|real|(?:tex|smallin)t)",
           "targets": [
-            "headers"
+            "user_agent"
           ],
           "action": "score",
           "score": 10,
@@ -4116,7 +4116,7 @@
           "name": "Restricted SQL Character Anomaly Detection (cookies): # of special characters exceeded (8)",
           "pattern": "((?:(?:[!-\\+\\-:->@\\[\\]\\^`\\{-~]|\\x{c2}\\x{b4}|\\x{e2}\\x80[\\x98\\x99])[^!-\\+\\-:->@\\[\\]\\^`\\{-~]*?){8})",
           "targets": [
-            "headers"
+            "cookies"
           ],
           "action": "score",
           "score": 5,
@@ -4222,7 +4222,7 @@
           "name": "Restricted SQL Character Anomaly Detection (cookies): # of special characters exceeded (3)",
           "pattern": "((?:(?:[!-\\+\\-:->@\\[\\]\\^`\\{-~]|\\x{c2}\\x{b4}|\\x{e2}\\x80[\\x98\\x99])[^!-\\+\\-:->@\\[\\]\\^`\\{-~]*?){3})",
           "targets": [
-            "headers"
+            "cookies"
           ],
           "action": "score",
           "score": 5,
@@ -4331,9 +4331,9 @@
           "name": "Java Injection Attack: Java Script File Upload Found",
           "pattern": ".*\\.(?:jsp|jspx)\\.*$",
           "targets": [
-            "headers"
+            "filename"
           ],
-          "action": "score",
+          "action": "block",
           "score": 10,
           "severity": "critical",
           "category": "deserialization",