Update OWASP CRS rules to v4.29.0

Automated update via update-feed.sh
CRS version: v4.29.0
Rules extracted: 282

rulesets.json

@@ -1,5 +1,5 @@
 {
-  "build_datetime": "2026-09-07T16:55:58Z",
+  "build_datetime": "2026-09-07T17:08:37Z",
   "owasp_top_10": {
     "version": "2025",
     "url": "https://owasp.org/Top10/2025/",
@@ -140,7 +140,7 @@
           "name": "Attempted multipart/form-data bypass",
           "pattern": "(?i)^(?:&(?:(?:[acegilnorsuz]acut|[aeiou]grav|[aino]tild)e|[c-elnr-tz]caron|(?:[cgklnr-t]cedi|[aeiouy]um)l|[aceg-josuwy]circ|[au]ring|a(?:mp|pos)|nbsp|oslash);|[^\"';=\\x5c])*$",
           "targets": [
-            "all"
+            "filename"
           ],
           "action": "block",
           "score": 10,
@@ -161,9 +161,9 @@
           "name": "Content-Length HTTP header is not numeric",
           "pattern": "^\\d+$",
           "targets": [
-            "headers"
+            "all"
           ],
-          "action": "score",
+          "action": "block",
           "score": 10,
           "severity": "critical",
           "category": "protocol",
@@ -182,9 +182,9 @@
           "name": "Multiple/Conflicting Connection Header Data Found",
           "pattern": "\\b(?:keep-alive|close),\\s?(?:keep-alive|close)\\b",
           "targets": [
-            "headers"
+            "all"
           ],
-          "action": "score",
+          "action": "block",
           "score": 5,
           "severity": "medium",
           "category": "protocol",
@@ -225,9 +225,9 @@
           "name": "Empty Host Header",
           "pattern": "^$",
           "targets": [
-            "headers"
+            "all"
           ],
-          "action": "score",
+          "action": "block",
           "score": 10,
           "severity": "critical",
           "category": "protocol",
@@ -246,9 +246,9 @@
           "name": "Empty User Agent Header",
           "pattern": "^$",
           "targets": [
-            "headers"
+            "user_agent"
           ],
-          "action": "score",
+          "action": "block",
           "score": 3,
           "severity": "low",
           "category": "protocol",
@@ -267,9 +267,9 @@
           "name": "Host header is a numeric IP address",
           "pattern": "(?:^([\\d.]+|\\[[\\da-f:]+\\]|[\\da-f:]+)(:[\\d]+)?$)",
           "targets": [
-            "headers"
+            "all"
           ],
-          "action": "score",
+          "action": "block",
           "score": 5,
           "severity": "medium",
           "category": "protocol",
@@ -288,9 +288,9 @@
           "name": "Illegal Content-Type header",
           "pattern": "^[\\w/.+*-]+(?:\\s?;\\s*(?:action|boundary|charset|component|start(?:-info)?|type|version)\\s?=\\s?['\"\\w.()+,/:=?<>@#*-]+)*$",
           "targets": [
-            "headers"
+            "all"
           ],
-          "action": "score",
+          "action": "block",
           "score": 10,
           "severity": "critical",
           "category": "protocol",
@@ -309,9 +309,9 @@
           "name": "Multiple charsets detected in content type header",
           "pattern": "charset.*?charset",
           "targets": [
-            "headers"
+            "all"
           ],
-          "action": "score",
+          "action": "block",
           "score": 10,
           "severity": "critical",
           "category": "protocol",
@@ -351,9 +351,9 @@
           "name": "Illegal Accept header: charset parameter",
           "pattern": "^(?:(?:\\*|[^!\"\\(\\),/:-\\?\\[-\\]\\{\\}]+)/(?:\\*|[^!\"\\(\\),/:-\\?\\[-\\]\\{\\}]+)|\\*)(?:[\\s\\x0b]*;[\\s\\x0b]*(?:charset[\\s\\x0b]*=[\\s\\x0b]*\"?(?:iso-8859-15?|utf-8|windows-1252)\\b\"?|(?:[^\\s\\x0b-\"\\(\\),/:-\\?\\[-\\]c\\{\\}]|c(?:[^!\"\\(\\),/:-\\?\\[-\\]h\\{\\}]|h(?:[^!\"\\(\\),/:-\\?\\[-\\]a\\{\\}]|a(?:[^!\"\\(\\),/:-\\?\\[-\\]r\\{\\}]|r(?:[^!\"\\(\\),/:-\\?\\[-\\]s\\{\\}]|s(?:[^!\"\\(\\),/:-\\?\\[-\\]e\\{\\}]|e[^!\"\\(\\),/:-\\?\\[-\\]t\\{\\}]))))))[^!\"\\(\\),/:-\\?\\[-\\]\\{\\}]*[\\s\\x0b]*=[\\s\\x0b]*[^!\\(\\),/:-\\?\\[-\\]\\{\\}]+);?)*(?:[\\s\\x0b]*,[\\s\\x0b]*(?:(?:\\*|[^!\"\\(\\),/:-\\?\\[-\\]\\{\\}]+)/(?:\\*|[^!\"\\(\\),/:-\\?\\[-\\]\\{\\}]+)|\\*)(?:[\\s\\x0b]*;[\\s\\x0b]*(?:charset[\\s\\x0b]*=[\\s\\x0b]*\"?(?:iso-8859-15?|utf-8|windows-1252)\\b\"?|(?:[^\\s\\x0b-\"\\(\\),/:-\\?\\[-\\]c\\{\\}]|c(?:[^!\"\\(\\),/:-\\?\\[-\\]h\\{\\}]|h(?:[^!\"\\(\\),/:-\\?\\[-\\]a\\{\\}]|a(?:[^!\"\\(\\),/:-\\?\\[-\\]r\\{\\}]|r(?:[^!\"\\(\\),/:-\\?\\[-\\]s\\{\\}]|s(?:[^!\"\\(\\),/:-\\?\\[-\\]e\\{\\}]|e[^!\"\\(\\),/:-\\?\\[-\\]t\\{\\}]))))))[^!\"\\(\\),/:-\\?\\[-\\]\\{\\}]*[\\s\\x0b]*=[\\s\\x0b]*[^!\\(\\),/:-\\?\\[-\\]\\{\\}]+);?)*)*$",
           "targets": [
-            "headers"
+            "all"
           ],
-          "action": "score",
+          "action": "block",
           "score": 10,
           "severity": "critical",
           "category": "protocol",
@@ -413,7 +413,7 @@
           "name": "Attempted multipart/form-data bypass",
           "pattern": "['\";=\\x5c]",
           "targets": [
-            "all"
+            "filename"
           ],
           "action": "score",
           "score": 10,
@@ -434,7 +434,7 @@
           "name": "Illegal Accept-Encoding header",
           "pattern": "br|compress|deflate|(?:pack200-)?gzip|identity|\\*|^$|aes128gcm|exi|zstd|x-(?:compress|gzip)",
           "targets": [
-            "headers"
+            "all"
           ],
           "action": "score",
           "score": 10,
@@ -455,7 +455,7 @@
           "name": "Invalid character in request headers (outside of very strict set)",
           "pattern": "^(?:\\?[01])?$",
           "targets": [
-            "headers"
+            "all"
           ],
           "action": "score",
           "score": 10,
@@ -677,9 +677,9 @@
           "name": "Content-Type header: Dangerous content type outside the mime type declaration",
           "pattern": "^[^\\s\\x0b,;]+[\\s\\x0b,;].*?(?:application/(?:.+\\+)?json|(?:application/(?:soap\\+)?|text/)xml)",
           "targets": [
-            "headers"
+            "all"
           ],
-          "action": "score",
+          "action": "block",
           "score": 10,
           "severity": "critical",
           "category": "protocol",
@@ -740,7 +740,7 @@
           "name": "Content-Type header: Dangerous content type outside the mime type declaration",
           "pattern": "^[^\\s\\x0b,;]+[\\s\\x0b,;].*?\\b(?:((?:tex|multipar)t|application)|((?:audi|vide)o|image|cs[sv]|(?:vn|relate)d|p(?:df|lain)|json|(?:soa|cs)p|x(?:ml|-www-form-urlencoded)|form-data|x-amf|(?:octe|repor)t|stream)|([\\+/]))\\b",
           "targets": [
-            "headers"
+            "all"
           ],
           "action": "score",
           "score": 10,
@@ -1220,6 +1220,7 @@
           "name": "Remote Command Execution: Shellshock (CVE-2014-6271)",
           "pattern": "^(?:json\\.)?\\([\\s\\x0b]*\\)[\\s\\x0b]+\\{",
           "targets": [
+            "filename",
             "query"
           ],
           "action": "block",
@@ -1346,7 +1347,7 @@
           "name": "Remote Command Execution: Unix Shell Expression Found",
           "pattern": "\\$(?:\\((?:[^\\)]+|\\([^\\)]+\\))\\)|\\{[^\\}]+\\}|\\[[^\\]]*\\])|[<>]\\([^\\)]+\\)|/[0-9A-Z_a-z]*\\[[^\\]]+\\]",
           "targets": [
-            "headers"
+            "user_agent"
           ],
           "action": "score",
           "score": 10,
@@ -1535,7 +1536,7 @@
           "name": "Remote Command Execution: Unix Command Injection found in user-agent or referer header",
           "pattern": "(?i)(?:^(?:json\\.|\\x5c)?|b[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?u[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?s[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?y[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?b[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?o[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?x|(?:c[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?o[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?m[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?m[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?a[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?n[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?d|e[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?(?:n[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?v|v[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?a[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?l)|w[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?a[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?t[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?c[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?h)[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?[\"']?[\\s\\x0b&\\),<>\\|].*|[ls][\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?t[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?r[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?a[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?c[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?e|n[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?o[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?h[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?u[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?p|t[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?i[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?m[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?e[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?(?:[\"']?[\\s\\x0b&\\),<>\\|].*|o[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?u[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?t)|[\\n\\r;=`\\{]|\\|\\|?|&&?|\\$(?:\\(\\(?|[\\[\\{])|<(?:\\(|<<)|>\\(|\\([\\s\\x0b]*\\))[\\s\\x0b]*(?:[!\\$\\(\\{][\\s\\x0b]*|(?:[0-9A-Z_a-z]+=[^\\s\\x0b]+|\\$[0-9A-Z_a-z]+)[\\s\\x0b]+)*[\\s\\x0b]*[\"']*(?:[\"'-\\+\\--9\\?A-\\]_a-z\\|]+/)?[\"'\\x5c]*(?:(?:7z[arx]?|(?:GE|POS)T|y(?:e(?:s|lp)|um|arn)|HEAD)[\"']?[\\s\\x0b&\\),<>\\|]|a(?:a-[^\\s\\x0b]{1,10}\\b|(?:b|w[ks]|l(?:ias|pine)|tobm|xel)[\"']?[\\s\\x0b&\\),<>\\|]|p(?:t(?:[\"']?[\\s\\x0b&\\),<>\\|]|-get)|parmor_[^\\s\\x0b]{1,10}\\b)|r(?:(?:p|ch)?[\"']?[\\s\\x0b&\\),<>\\|]|j(?:[\"']?[\\s\\x0b&\\),<>\\|]|-register|disp)|ia2c)|s(?:h[\"']?[\\s\\x0b&\\),<>\\|]|cii(?:-xfr|85)|pell)|dd(?:group|user)|getty|nsible|u(?:ditctl|repot|search))|b(?:z(?:(?:z|c(?:at|mp))[\"']?[\\s\\x0b&\\),<>\\|]|diff|e(?:grep|xe[\"']?[\\s\\x0b&\\),<>\\|])|f?grep|ip2(?:[\"']?[\\s\\x0b&\\),<>\\|]|recover)|less|more)|a(?:s(?:e(?:32|64[\"']?[\\s\\x0b&\\),<>\\|]|n(?:ame[\"']?[\\s\\x0b&\\),<>\\|]|c))|h[\"']?[\\s\\x0b&\\),<>\\|])|tch[\"']?[\\s\\x0b&\\),<>\\|])|lkid[\"']?[\\s\\x0b&\\),<>\\|]|pftrace|r(?:eaksw|(?:idge|wap)[\"']?[\\s\\x0b&\\),<>\\|])|sd(?:cat|iff|tar)|u(?:iltin|n(?:dler[\"']?[\\s\\x0b&\\),<>\\|]|zip2)|s(?:ctl|ybox))|y(?:ebug|obu[\"']?[\\s\\x0b&\\),<>\\|]))|c(?:[89]9(?:[\"']?[\\s\\x0b&\\),<>\\|]|-gcc)|a(?:(?:t|ncel|psh)[\"']?[\\s\\x0b&\\),<>\\|]|rgo(?:-(?:audit|miri|watch)|[\"']?[\\s\\x0b&\\),<>\\|]))|(?:c|mp)[\"']?[\\s\\x0b&\\),<>\\|]|p(?:(?:an|io)?[\"']?[\\s\\x0b&\\),<>\\|]|ulimit)|s(?:(?:h|cli)[\"']?[\\s\\x0b&\\),<>\\|]|plit|vtool)|u(?:t[\"']?[\\s\\x0b&\\),<>\\|]|psfilter)|ertbot|h(?:(?:(?:att|di)r|mod|o(?:om|wn)|root|sh)[\"']?[\\s\\x0b&\\),<>\\|]|e(?:ck_(?:by_ssh|cups|log|memory|raid|s(?:sl_cert|tatusfile))|f(?:-|[\"']?[\\s\\x0b&\\),<>\\|]Line truncated
           "targets": [
-            "headers"
+            "user_agent"
           ],
           "action": "score",
           "score": 10,
@@ -1598,7 +1599,7 @@
           "name": "Remote Command Execution: Unix Shell Code Found in REQUEST_HEADERS",
           "pattern": "(?i)\\b(?:(?:7z[arx]?|(?:GE|POS)T|y(?:e(?:s|lp)|um|arn)|HEAD)[\"']?[\\s\\x0b&\\),<>\\|]|a(?:a-[^\\s\\x0b]{1,10}\\b|(?:b|t(?:obm)?|w[ks]|l(?:ias|pine)|xel)[\"']?[\\s\\x0b&\\),<>\\|]|p(?:t(?:(?:itude)?[\"']?[\\s\\x0b&\\),<>\\|]|-get)|parmor_[^\\s\\x0b]{1,10}\\b)|r(?:(?:p|ch)?[\"']?[\\s\\x0b&\\),<>\\|]|j(?:[\"']?[\\s\\x0b&\\),<>\\|]|-register|disp)|ia2c)|s(?:h?[\"']?[\\s\\x0b&\\),<>\\|]|cii(?:-xfr|85)|pell)|dd(?:group|user)|getty|nsible|u(?:ditctl|repot|search))|b(?:z(?:(?:z|c(?:at|mp))[\"']?[\\s\\x0b&\\),<>\\|]|diff|e(?:grep|xe[\"']?[\\s\\x0b&\\),<>\\|])|f?grep|ip2(?:[\"']?[\\s\\x0b&\\),<>\\|]|recover)|less|more)|a(?:s(?:e(?:32|64[\"']?[\\s\\x0b&\\),<>\\|]|n(?:ame[\"']?[\\s\\x0b&\\),<>\\|]|c))|h[\"']?[\\s\\x0b&\\),<>\\|])|tch[\"']?[\\s\\x0b&\\),<>\\|])|lkid[\"']?[\\s\\x0b&\\),<>\\|]|pftrace|r(?:eaksw|(?:idge|wap)[\"']?[\\s\\x0b&\\),<>\\|])|sd(?:cat|iff|tar)|u(?:iltin|n(?:dler[\"']?[\\s\\x0b&\\),<>\\|]|zip2)|s(?:ctl|ybox))|y(?:ebug|obu[\"']?[\\s\\x0b&\\),<>\\|]))|c(?:[89]9(?:[\"']?[\\s\\x0b&\\),<>\\|]|-gcc)|a(?:(?:t|ncel|psh)[\"']?[\\s\\x0b&\\),<>\\|]|rgo(?:-(?:audit|miri|watch)|[\"']?[\\s\\x0b&\\),<>\\|]))|(?:c|mp)[\"']?[\\s\\x0b&\\),<>\\|]|p(?:(?:an|io)?[\"']?[\\s\\x0b&\\),<>\\|]|ulimit)|s(?:(?:h|cli)[\"']?[\\s\\x0b&\\),<>\\|]|plit|vtool)|u(?:t[\"']?[\\s\\x0b&\\),<>\\|]|psfilter)|ertbot|h(?:(?:(?:att|di)r|mod|o(?:om|wn)|root|sh)[\"']?[\\s\\x0b&\\),<>\\|]|e(?:ck_(?:by_ssh|cups|log|memory|raid|s(?:sl_cert|tatusfile))|f(?:-|[\"']?[\\s\\x0b&\\),<>\\|]))|(?:flag|pas)s|g(?:passwd|rp[\"']?[\\s\\x0b&\\),<>\\|]))|l(?:ang(?:\\+\\+|[\"']?[\\s\\x0b&\\),<>\\|])|ippy-driver)|o(?:bc(?:[\"']?[\\s\\x0b&\\),<>\\|]|run)|(?:lumn|m(?:m(?:and)?|p(?:oser|ress)))[\"']?[\\s\\x0b&\\),<>\\|]|proc|w(?:say|think))|r(?:ash[\"']?[\\s\\x0b&\\),<>\\|]|on(?:[\"']?[\\s\\x0b&\\),<>\\|]|tab)))|d(?:(?:[dfu]|i(?:(?:alo)?g|r|ff)|a(?:sh|te)|vips)[\"']?[\\s\\x0b&\\),<>\\|]|nf(?:[\"']?[\\s\\x0b&\\),<>\\|])?|hclient|m(?:esg[\"']?[\\s\\x0b&\\),<>\\|]|idecode|setup)|o(?:(?:as|ne)[\"']?[\\s\\x0b&\\),<>\\|]|cker(?:-|[\"']?[\\s\\x0b&\\),<>\\|])|sbox)|pkg(?:-|[\"']?[\\s\\x0b&\\),<>\\|]))|e(?:(?:[bd]|qn|s(?:h|ac)?|cho|fax|grep|macs|val)[\"']?[\\s\\x0b&\\),<>\\|]|n(?:v(?:[\"']?[\\s\\x0b&\\),<>\\|]|-update)|d(?:if|sw)[\"']?[\\s\\x0b&\\),<>\\|])|x(?:(?:ec|p(?:and|(?:ec|or)t|r))?[\"']?[\\s\\x0b&\\),<>\\|]|iftool)|2fsck|asy_install)|f(?:(?:c|g(?:rep)?|mt|etch|lock|unction)[\"']?[\\s\\x0b&\\),<>\\|]|i(?:(?:n(?:d|ger)|sh)?[\"']?[\\s\\x0b&\\),<>\\|]|le(?:[\"']?[\\s\\x0b&\\),<>\\|]|test))|tp(?:[\"']?[\\s\\x0b&\\),<>\\|]|stats|who)|acter|d(?:(?:find|isk)[\"']?[\\s\\x0b&\\),<>\\|]|u?mount)|o(?:ld[\"']?[\\s\\x0b&\\),<>\\|]|reach)|ping(?:6|[\"']?[\\s\\x0b&\\),<>\\|]))|g(?:c(?:c[^\\s\\x0b]{1,10}\\b|ore[\"']?[\\s\\x0b&\\),<>\\|])|(?:db|i(?:t|mp|nsh)|o|pg|awk|z(?:cat|exe|ip))[\"']?[\\s\\x0b&\\),<>\\|]|e(?:m[\"']?[\\s\\x0b&\\),<>\\|]|ni(?:e[\"']?[\\s\\x0b&\\),<>\\|]|soimage)|t(?:cap|facl[\"']?[\\s\\x0b&\\),<>\\|]))|hc(?:-?[\"']?[\\s\\x0b&\\),<>\\|]|i(?:-|[\"']?[\\s\\x0b&\\),<>\\|]))|r(?:(?:c(?:at)?|ep)[\"']?[\\s\\x0b&\\),<>\\|]|oupmod)|tester|unzip)|h(?:(?:d|up|ash|i(?:ghlight|story))[\"']?[\\s\\x0b&\\),<>\\|]|e(?:ad[\"']?[\\s\\x0b&\\),<>\\|]|xdump)|ost(?:id|name)|ping3|t(?:digest|op[\"']?[\\s\\x0b&\\),<>\\|]|passwd))|i(?:(?:d|rb|conv|nstall)[\"']?[\\s\\x0b&\\),<>\\|]|p(?:[\"']?[\\s\\x0b&\\),<>\\|]|6?tables|config|p(?:eveprinter|find|tool))|f(?:config|top[\"']?[\\s\\x0b&\\),<>\\|])|onice|spell)|j(?:(?:js|q|ava|exec)[\"']?[\\s\\x0b&\\),<>\\|]|o(?:(?:bs|in)[\"']?[\\s\\x0b&\\),<>\\|]|urnalctl)|runscript)|k(?:s(?:h[\"']?[\\s\\x0b&\\),<>\\|]|shell)|ill(?:[\"']?[\\s\\x0b&\\),<>\\|]|all)|nife[\"']?[\\s\\x0b&\\),<>\\|])|l(?:(?:a(?:st(?:comm|log(?:in)?)?|tex)?|[lnp]|ynx)?[\"']?[\\s\\x0b&\\),<>\\|]|d(?:d?[\"']?[\\s\\x0b&\\),<>\\|]|config)|s(?:(?:-F|cpu|hw|mod|of|pci|usb)?[\"']?[\\s\\x0b&\\),<>\\|]|b_release)|ua(?:[\"']?[\\s\\x0b&\\),<>\\|]|(?:la)?tex)|z(?:4(?:[\"']?[\\s\\x0b&\\),<>\\|]|c(?:[\"']?[\\s\\x0b&\\),<>\\|]|at))|(?:c(?:at|mp))?[\"']?[\\s\\x0b&\\),<>\\|]|diff|[ef]?grep|less|m(?:a(?:[\"']?[\\s\\x0b&\\),<>\\|]|dec|info)|ore))|ess(?:[\"']?[\\s\\x0b&\\),<>\\|]|echo|(?:fil|pip)e)|ftp(?:[\"']?[\\s\\x0b&\\),<>\\|]|get)|o(?:(?:ca(?:l|te)|ok)[\"']?[\\s\\x0b&\\),<>\\|]|g(?:inctl|(?:nam|sav)e)|setup)|trace|wp-(?:d(?:ownload|ump)|mirror|request))|m(?:(?:a(?:n|il[qx]?|ke|wk)|tr|v|utt)[\"']?[\\s\\x0b&\\),<>\\|]|k(?:(?:dir|nod)[\"']?[\\s\\x0b&\\),<>\\|]|fifo|temp)|locate|o(?:(?:re|unt)[\"']?[\\s\\x0b&\\),<>\\|]|squitto)|sg(?:attrib|c(?:at|onv)|filter|merge|uniq)|ysql(?:[\"']?[\\s\\x0b&\\),<>\\|]|admin|dump(?:slow)?|hotcopy|show))|n(?:c(?:(?:at)?[\"']?[\\s\\x0b&\\),<>\\|]|\\.(?:openbsd|traditional))|e(?:t(?:[\"']?[\\s\\x0b&\\),<>\\|]|(?:c|st)at|kit-ftp|plan)|ofetch)|(?:l|m(?:ap)?|p(?:m|ing)|a(?:no|sm|wk)|ice|o(?:de|hup)|roff)[\"']?[\\s\\x0b&\\),<>\\|]|s(?:enter|lookup|tat[\"']?[\\s\\x0b&\\),<>\\|]))|o(?:(?:d|ctave)[\"']?[\\s\\x0b&\\),<>\\|]|nintr|p(?:en(?:ssl|v(?:pn|t))|kg[\"']?[\\s\\x0b&\\),<>\\|]))|p(?:a(?:(?:x|cman|rted|tch)[\"']?[\\s\\x0b&\\),<>\\|]|s(?:swd|te[\"']?Line truncated
           "targets": [
-            "headers"
+            "user_agent"
           ],
           "action": "score",
           "score": 10,
@@ -1820,9 +1821,9 @@
           "name": "PHP Injection Attack: PHP Script File Upload Found",
           "pattern": ".*\\.ph(?:p\\d*|tml|ar|ps|t|pt)\\.*$",
           "targets": [
-            "headers"
+            "filename"
           ],
-          "action": "score",
+          "action": "block",
           "score": 10,
           "severity": "critical",
           "category": "rce",
@@ -2009,9 +2010,9 @@
           "name": "PHP Injection Attack: PHP Session File Upload Attempt",
           "pattern": "(?:^|[/\\x5c])sess_[,\\-0-9a-z]{20,256}$",
           "targets": [
-            "headers"
+            "filename"
           ],
-          "action": "score",
+          "action": "block",
           "score": 10,
           "severity": "critical",
           "category": "rce",
@@ -2135,7 +2136,7 @@
           "name": "PHP Injection Attack: PHP Script File Upload Found",
           "pattern": ".*\\.ph(?:p\\d*|tml|ar|ps|t|pt)\\..*$",
           "targets": [
-            "headers"
+            "filename"
           ],
           "action": "score",
           "score": 10,
@@ -2967,7 +2968,6 @@
           "name": "XSS Attack Detected via libinjection",
           "pattern": "@detectXSS",
           "targets": [
-            "headers",
             "uri"
           ],
           "action": "score",
@@ -4032,7 +4032,7 @@
           "name": "SQL Injection Attack: SQL function name detected",
           "pattern": "(?i)\\b(?:a(?:dd(?:dat|tim)e|es_(?:de|en)crypt|s(?:cii(?:str)?|in)|tan2?)|b(?:enchmark|i(?:n_to_num|t_(?:and|count|length|x?or)))|c(?:har(?:acter)?_length|eil(?:ing)?|o(?:alesce|ercibility|llation|(?:mpres)?s|n(?:cat(?:_ws)?|nection_id|v(?:ert(?:_tz)?)?)|t)|rc32|ur(?:(?:dat|tim)e|rent_(?:date|setting|time(?:stamp)?|user)))|d(?:a(?:t(?:abase(?:_to_xml)?|e(?:_(?:add|format|sub)|diff))|y(?:name|of(?:month|week|year)))|count|e(?:code|grees|s_(?:de|en)crypt)|ump)|e(?:lt|n(?:c(?:ode|rypt)|ds_?with)|x(?:p(?:ort_set)?|tract(?:value)?))|f(?:i(?:el|n)d_in_set|ound_rows|rom_(?:base64|days|unixtime))|g(?:e(?:ometrycollection|t(?:_(?:format|lock)|pgusername))|(?:r(?:eates|oup_conca)|tid_subse)t)|hex(?:toraw)?|i(?:fnull|n(?:et6?_(?:aton|ntoa)|s(?:ert|tr)|terval)|s(?:_(?:(?:free|used)_lock|ipv(?:4(?:_(?:compat|mapped))?|6)|n(?:ot(?:_null)?|ull)|superuser)|null))|json(?:_(?:a(?:gg|rray(?:_(?:elements(?:_text)?|length))?)|build_(?:array|object)|e(?:ac|xtract_pat)h(?:_text)?|object(?:_(?:agg|keys))?|populate_record(?:set)?|strip_nulls|t(?:o_record(?:set)?|ypeof))|b(?:_(?:array(?:_(?:elements(?:_text)?|length))?|build_(?:array|object)|object(?:_(?:agg|keys))?|e(?:ac|xtract_pat)h(?:_text)?|insert|p(?:ath_(?:(?:exists|match)(?:_tz)?|query(?:_(?:(?:array|first)(?:_tz)?|tz))?)|opulate_record(?:set)?|retty)|s(?:et(?:_lax)?|trip_nulls)|t(?:o_record(?:set)?|ypeof)))?|path)?|l(?:ast_(?:day|insert_id)|case|e(?:as|f)t|i(?:kel(?:ihood|y)|nestring)|o(?:_(?:from_bytea|put)|ad_file|ca(?:ltimestamp|te)|g(?:10|2)|wer)|pad|trim)|m(?:a(?:ke(?:_set|date)|ster_pos_wait)|d5|i(?:crosecon)?d|onthname|ulti(?:linestring|po(?:int|lygon)))|n(?:ame_const|ot_in|ullif)|o(?:ct(?:et_length)?|(?:ld_passwo)?rd)|p(?:eriod_(?:add|diff)|g_(?:client_encoding|(?:databas|read_fil)e|l(?:argeobject|s_dir)|sleep|user)|o(?:(?:lyg|siti)on|w)|rocedure_analyse)|qu(?:arter|ery_to_xml|ote)|r(?:a(?:dians|nd|wtohex)|elease_lock|ow_(?:count|to_json)|pad|trim)|s(?:chema|e(?:c_to_time|ssion_user)|ha[12]?|in|oundex|pace|q(?:lite_(?:compileoption_(?:get|used)|source_id)|rt)|t(?:arts_?with|d(?:dev_(?:po|sam)p)?|r(?:_to_date|cmp))|ub(?:(?:dat|tim)e|str(?:ing(?:_index)?)?)|ys(?:date|tem_user))|t(?:ime(?:_(?:format|to_sec)|diff|stamp(?:add|diff)?)|o(?:_(?:base64|jsonb?)|n?char|(?:day|second)s)|r(?:im|uncate))|u(?:case|n(?:compress(?:ed_length)?|hex|i(?:str|x_timestamp)|likely)|(?:pdatexm|se_json_nul)l|tc_(?:date|time(?:stamp)?)|uid(?:_short)?)|var(?:_(?:po|sam)p|iance)|we(?:ek(?:day|ofyear)|ight_string)|xmltype|yearweek)[^0-9A-Z_a-z]*\\(",
           "targets": [
-            "headers"
+            "user_agent"
           ],
           "action": "score",
           "score": 10,
@@ -4053,7 +4053,7 @@
           "name": "Detects MySQL and PostgreSQL stored procedure/function injections",
           "pattern": "(?i)create[\\s\\x0b]+(?:function|procedure)[\\s\\x0b]*?[0-9A-Z_a-z]+[\\s\\x0b]*?\\([\\s\\x0b]*?\\)[\\s\\x0b]*?-|d(?:eclare[^0-9A-Z_a-z]+[#@][\\s\\x0b]*?[0-9A-Z_a-z]+|iv[\\s\\x0b]*?\\([\\+\\-]*[\\s\\x0b\\.0-9]+,[\\+\\-]*[\\s\\x0b\\.0-9]+\\))|exec[\\s\\x0b]*?\\([\\s\\x0b]*?@|(?:lo_(?:impor|ge)t|procedure[\\s\\x0b]+analyse)[\\s\\x0b]*?\\(|;[\\s\\x0b]*?(?:declare|open)[\\s\\x0b]+[\\-0-9A-Z_a-z]+|::(?:b(?:igint|ool)|double[\\s\\x0b]+precision|int(?:eger)?|numeric|oid|real|(?:tex|smallin)t)",
           "targets": [
-            "headers"
+            "user_agent"
           ],
           "action": "score",
           "score": 10,
@@ -4116,7 +4116,7 @@
           "name": "Restricted SQL Character Anomaly Detection (cookies): # of special characters exceeded (8)",
           "pattern": "((?:(?:[!-\\+\\-:->@\\[\\]\\^`\\{-~]|\\x{c2}\\x{b4}|\\x{e2}\\x80[\\x98\\x99])[^!-\\+\\-:->@\\[\\]\\^`\\{-~]*?){8})",
           "targets": [
-            "headers"
+            "cookies"
           ],
           "action": "score",
           "score": 5,
@@ -4222,7 +4222,7 @@
           "name": "Restricted SQL Character Anomaly Detection (cookies): # of special characters exceeded (3)",
           "pattern": "((?:(?:[!-\\+\\-:->@\\[\\]\\^`\\{-~]|\\x{c2}\\x{b4}|\\x{e2}\\x80[\\x98\\x99])[^!-\\+\\-:->@\\[\\]\\^`\\{-~]*?){3})",
           "targets": [
-            "headers"
+            "cookies"
           ],
           "action": "score",
           "score": 5,
@@ -4331,9 +4331,9 @@
           "name": "Java Injection Attack: Java Script File Upload Found",
           "pattern": ".*\\.(?:jsp|jspx)\\.*$",
           "targets": [
-            "headers"
+            "filename"
           ],
-          "action": "score",
+          "action": "block",
           "score": 10,
           "severity": "critical",
           "category": "deserialization",