Update OWASP CRS rules to v4.30.0
Automated update via update-feed.sh CRS version: v4.30.0 Rules extracted: 272
This commit is contained in:
Andre committed
1 parent
6ca0cd5d20
commit
c44ea2e648
1 file changed
+71
-48
+71
-48
@@ -1,5 +1,5 @@
|
||||
{
|
||||
"build_datetime": "2026-09-07T17:14:52Z",
|
||||
"build_datetime": "2026-10-23T00:35:30Z",
|
||||
"owasp_top_10": {
|
||||
"version": "2025",
|
||||
"url": "https://owasp.org/Top10/2025/",
|
||||
@@ -107,9 +107,9 @@
|
||||
{
|
||||
"id": "crs-protocol-enforcement",
|
||||
"name": "CRS Protocol Enforcement",
|
||||
"version": "4.29.0",
|
||||
"version": "4.30.0",
|
||||
"source": "owasp-crs",
|
||||
"description": "OWASP CRS v4.29.0 — CRS Protocol Enforcement (9 rules)",
|
||||
"description": "OWASP CRS v4.30.0 — CRS Protocol Enforcement (9 rules)",
|
||||
"author": "OWASP CRS Project",
|
||||
"priority": 15,
|
||||
"enabled": true,
|
||||
@@ -309,9 +309,9 @@
|
||||
{
|
||||
"id": "crs-protocol-attack",
|
||||
"name": "CRS Protocol Attack (HTTP Smuggling)",
|
||||
"version": "4.29.0",
|
||||
"version": "4.30.0",
|
||||
"source": "owasp-crs",
|
||||
"description": "OWASP CRS v4.29.0 — CRS Protocol Attack (HTTP Smuggling) (12 rules)",
|
||||
"description": "OWASP CRS v4.30.0 — CRS Protocol Attack (HTTP Smuggling) (12 rules)",
|
||||
"author": "OWASP CRS Project",
|
||||
"priority": 5,
|
||||
"enabled": true,
|
||||
@@ -573,9 +573,9 @@
|
||||
{
|
||||
"id": "crs-lfi",
|
||||
"name": "CRS Local File Inclusion (LFI)",
|
||||
"version": "4.29.0",
|
||||
"version": "4.30.0",
|
||||
"source": "owasp-crs",
|
||||
"description": "OWASP CRS v4.29.0 — CRS Local File Inclusion (LFI) (2 rules)",
|
||||
"description": "OWASP CRS v4.30.0 — CRS Local File Inclusion (LFI) (2 rules)",
|
||||
"author": "OWASP CRS Project",
|
||||
"priority": 5,
|
||||
"enabled": true,
|
||||
@@ -627,9 +627,9 @@
|
||||
{
|
||||
"id": "crs-rfi",
|
||||
"name": "CRS Remote File Inclusion (RFI)",
|
||||
"version": "4.29.0",
|
||||
"version": "4.30.0",
|
||||
"source": "owasp-crs",
|
||||
"description": "OWASP CRS v4.29.0 — CRS Remote File Inclusion (RFI) (4 rules)",
|
||||
"description": "OWASP CRS v4.30.0 — CRS Remote File Inclusion (RFI) (4 rules)",
|
||||
"author": "OWASP CRS Project",
|
||||
"priority": 5,
|
||||
"enabled": true,
|
||||
@@ -725,9 +725,9 @@
|
||||
{
|
||||
"id": "crs-rce",
|
||||
"name": "CRS Remote Code Execution (RCE)",
|
||||
"version": "4.29.0",
|
||||
"version": "4.30.0",
|
||||
"source": "owasp-crs",
|
||||
"description": "OWASP CRS v4.29.0 — CRS Remote Code Execution (RCE) (39 rules)",
|
||||
"description": "OWASP CRS v4.30.0 — CRS Remote Code Execution (RCE) (40 rules)",
|
||||
"author": "OWASP CRS Project",
|
||||
"priority": 3,
|
||||
"enabled": true,
|
||||
@@ -756,7 +756,7 @@
|
||||
{
|
||||
"id": "932235",
|
||||
"name": "Remote Command Execution: Unix Command Injection (command without evasion)",
|
||||
"pattern": "(?i)(?:b[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?u[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?s[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?y[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?b[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?o[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?x|(?:c[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?o[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?m[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?m[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?a[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?n[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?d|e[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?(?:n[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?v|v[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?a[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?l)|w[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?a[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?t[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?c[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?h)[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?[\"']?[\\s\\x0b&\\),<>\\|].*|[ls][\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?t[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?r[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?a[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?c[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?e|n[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?o[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?h[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?u[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?p|t[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?i[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?m[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?e[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?(?:[\"']?[\\s\\x0b&\\),<>\\|].*|o[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?u[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?t)|[\\n\\r;=`\\{]|\\|\\|?|&&?|^\\x5c|\\$(?:\\(\\(?|[\\[\\{])|<(?:\\(|<<)|>\\(|\\([\\s\\x0b]*\\))[\\s\\x0b]*(?:[!\\$\\(\\{][\\s\\x0b]*|(?:[0-9A-Z_a-z]+=[^\\s\\x0b]+|\\$[0-9A-Z_a-z]+)[\\s\\x0b]+)*[\\s\\x0b]*[\"']*(?:[\"'-\\+\\--9\\?A-\\]_a-z\\|]+/)?[\"'\\x5c]*(?:(?:HEAD|POST|y(?:arn|elp))[\"']?[\\s\\x0b&\\),<>\\|]|a(?:dd(?:group|user)|getty|(?:l(?:ias|pine)|tobm|xel)[\"']?[\\s\\x0b&\\),<>\\|]|nsible|p(?:parmor_[^\\s\\x0b]{1,10}\\b|t(?:-get|itude[\"']?[\\s\\x0b&\\),<>\\|]))|r(?:ch[\"']?[\\s\\x0b&\\),<>\\|]|ia2c|j(?:-register|disp))|s(?:cii(?:-xfr|85)|pell)|u(?:ditctl|repot|search))|b(?:a(?:s(?:e(?:32|64[\"']?[\\s\\x0b&\\),<>\\|]|n(?:ame[\"']?[\\s\\x0b&\\),<>\\|]|c))|h[\"']?[\\s\\x0b&\\),<>\\|])|tch[\"']?[\\s\\x0b&\\),<>\\|])|lkid[\"']?[\\s\\x0b&\\),<>\\|]|pftrace|r(?:eaksw|(?:idge|wap)[\"']?[\\s\\x0b&\\),<>\\|])|sd(?:cat|iff|tar)|u(?:iltin|n(?:dler[\"']?[\\s\\x0b&\\),<>\\|]|zip2)|s(?:ctl|ybox))|y(?:ebug|obu[\"']?[\\s\\x0b&\\),<>\\|])|z(?:c(?:at|mp)[\"']?[\\s\\x0b&\\),<>\\|]|diff|e(?:grep|xe[\"']?[\\s\\x0b&\\),<>\\|])|f?grep|ip2(?:[\"']?[\\s\\x0b&\\),<>\\|]|recover)|less|more))|c(?:[89]9-gcc|a(?:(?:ncel|psh)[\"']?[\\s\\x0b&\\),<>\\|]|rgo(?:-(?:audit|miri|watch)|[\"']?[\\s\\x0b&\\),<>\\|]))|ertbot|h(?:(?:(?:att|di)r|mod|o(?:om|wn)|root|sh)[\"']?[\\s\\x0b&\\),<>\\|]|e(?:ck_(?:by_ssh|cups|log|memory|raid|s(?:sl_cert|tatusfile))|f(?:-|[\"']?[\\s\\x0b&\\),<>\\|]))|(?:flag|pas)s|g(?:passwd|rp[\"']?[\\s\\x0b&\\),<>\\|]))|l(?:ang(?:\\+\\+|[\"']?[\\s\\x0b&\\),<>\\|])|ippy-driver)|o(?:bc(?:[\"']?[\\s\\x0b&\\),<>\\|]|run)|(?:lumn|m(?:m(?:and)?|p(?:oser|ress)))[\"']?[\\s\\x0b&\\),<>\\|]|proc|w(?:say|think))|p(?:(?:an|io)[\"']?[\\s\\x0b&\\),<>\\|]|ulimit)|r(?:ash[\"']?[\\s\\x0b&\\),<>\\|]|on(?:[\"']?[\\s\\Line truncated
|
||||
"pattern": "(?i)(?:b[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?u[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?s[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?y[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?b[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?o[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?x|(?:c[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?o[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?m[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?m[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?a[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?n[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?d|e[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?(?:n[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?v|v[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?a[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?l)|w[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?a[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?t[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?c[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?h)[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?[\"']?[\\s\\x0b&\\),<>\\|].*|[ls][\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?t[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?r[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?a[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?c[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?e|n[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?o[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?h[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?u[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?p|t[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?i[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?m[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?e[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?(?:[\"']?[\\s\\x0b&\\),<>\\|].*|o[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?u[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?t)|[\\n\\r;=`\\{]|\\|\\|?|&&?|^\\x5c|\\$(?:\\(\\(?|[\\[\\{])|<(?:\\(|<<)|>\\(|\\([\\s\\x0b]*\\))[\\s\\x0b]*(?:[!\\$\\(\\{][\\s\\x0b]*|(?:[0-9A-Z_a-z]+=[^\\s\\x0b]+|\\$[0-9A-Z_a-z]+)[\\s\\x0b]+)*[\\s\\x0b]*[\"']*(?:[\"'-\\+\\--9\\?A-\\]_a-z\\|]+/)?[\"'\\x5c]*(?:(?:HEAD|POST|y(?:arn|elp))[\"']?[\\s\\x0b&\\),<>\\|]|a(?:dd(?:group|user)|getty|(?:l(?:ias|pine)|tobm|xel)[\"']?[\\s\\x0b&\\),<>\\|]|nsible|p(?:parmor_[^\\s\\x0b]{1,10}\\b|t(?:-get|itude[\"']?[\\s\\x0b&\\),<>\\|]))|r(?:ch[\"']?[\\s\\x0b&\\),<>\\|]|ia2c|j(?:-register|disp))|s(?:cii(?:-xfr|85)|pell)|u(?:dit(?:2(?:allow|why)|ctl)|repor?t|search)|vcstat)|b(?:a(?:s(?:e(?:32|64[\"']?[\\s\\x0b&\\),<>\\|]|n(?:ame[\"']?[\\s\\x0b&\\),<>\\|]|c))|h[\"']?[\\s\\x0b&\\),<>\\|])|tch[\"']?[\\s\\x0b&\\),<>\\|])|lkid[\"']?[\\s\\x0b&\\),<>\\|]|pftrace|r(?:eaksw|(?:idge|wap)[\"']?[\\s\\x0b&\\),<>\\|])|sd(?:cat|iff|tar)|u(?:iltin|n(?:dler[\"']?[\\s\\x0b&\\),<>\\|]|zip2)|s(?:ctl|ybox))|y(?:ebug|obu[\"']?[\\s\\x0b&\\),<>\\|])|z(?:c(?:at|mp)[\"']?[\\s\\x0b&\\),<>\\|]|diff|e(?:grep|xe[\"']?[\\s\\x0b&\\),<>\\|])|f?grep|ip2(?:[\"']?[\\s\\x0b&\\),<>\\|]|recover)|less|more))|c(?:[89]9-gcc|a(?:(?:ncel|psh)[\"']?[\\s\\x0b&\\),<>\\|]|rgo(?:-(?:audit|miri|watch)|[\"']?[\\s\\x0b&\\),<>\\|]))|ertbot|h(?:(?:(?:att|di)r|c(?:at|on)|mod|o(?:om|wn)|root|sh)[\"']?[\\s\\x0b&\\),<>\\|]|e(?:ck(?:_(?:by_ssh|cups|log|memory|raid|s(?:sl_cert|tatusfile))|module|policy)|f(?:-|[\"']?[\\s\\x0b&\\),<>\\|]))|(?:flag|pas)s|g(?:passwd|rp[\"']?[\\s\\x0b&\\),<>\\|]))|l(?:ang(?:\\+\\+|[\"']?[\\s\\x0b&\\),<>\\|])|ippy-driver)|o(?:bc(?:[\"']?[\\s\\x0b&\\),<>\\|]|run)|(?:lumn|m(?:m(?:and)?|p(?:oser|ress)))[\"']?[\\s\\x0b&\\),<>\\|]|proc|w(?:say|think))|p(?:(?:an|io)[\"']?[\\s\\x0b&\\),<>\\|]|ulLine truncated
|
||||
"targets": [
|
||||
"all"
|
||||
],
|
||||
@@ -840,7 +840,7 @@
|
||||
{
|
||||
"id": "932270",
|
||||
"name": "Remote Command Execution: Unix Shell Expression Found",
|
||||
"pattern": "~[\\+\\-](?:$|[0-9]+)",
|
||||
"pattern": "(?:^|[\\s\\x0b\\$&\\(:->`\\|])~[\\+\\-](?:$|[0-9]+)",
|
||||
"targets": [
|
||||
"all"
|
||||
],
|
||||
@@ -903,7 +903,7 @@
|
||||
{
|
||||
"id": "932260",
|
||||
"name": "Remote Command Execution: Direct Unix Command Execution",
|
||||
"pattern": "(?i)(?:^(?:json\\.|\\x5c)?|b[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?u[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?s[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?y[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?b[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?o[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?x|(?:c[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?o[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?m[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?m[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?a[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?n[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?d|e[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?(?:n[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?v|v[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?a[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?l)|w[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?a[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?t[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?c[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?h)[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?[\"']?[\\s\\x0b&\\),<>\\|].*|[ls][\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?t[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?r[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?a[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?c[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?e|n[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?o[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?h[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?u[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?p|t[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?i[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?m[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?e[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?(?:[\"']?[\\s\\x0b&\\),<>\\|].*|o[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?u[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?t)|[\\n\\r;=`\\{]|\\|\\|?|&&?|\\$(?:\\(\\(?|[\\[\\{])|<(?:\\(|<<)|>\\(|\\([\\s\\x0b]*\\))[\\s\\x0b]*(?:[!\\$\\(\\{][\\s\\x0b]*|(?:[0-9A-Z_a-z]+=[^\\s\\x0b]+|\\$[0-9A-Z_a-z]+)[\\s\\x0b]+)*[\\s\\x0b]*[\"']*(?:[\"'-\\+\\--9\\?A-\\]_a-z\\|]+/)?[\"'\\x5c]*(?:a(?:ddgroup|nsible|pparmor_[^\\s\\x0b]{1,10}\\b|rj(?:-register|disp)|tobm[\"']?[\\s\\x0b&\\),<>\\|]|u(?:ditctl|repot|search))|b(?:ase(?:32|64[\"']?[\\s\\x0b&\\),<>\\|]|nc)|(?:lkid|rwap|yobu)[\"']?[\\s\\x0b&\\),<>\\|]|sd(?:cat|iff|tar)|u(?:iltin|nzip2|sybox)|z(?:c(?:at|mp)[\"']?[\\s\\x0b&\\),<>\\|]|diff|e(?:grep|xe[\"']?[\\s\\x0b&\\),<>\\|])|f?grep|ip2(?:[\"']?[\\s\\x0b&\\),<>\\|]|recover)|less|more))|c(?:[89]9-gcc|argo-(?:audit|miri|watch)|h(?:(?:attr|mod|o(?:om|wn)|sh)[\"']?[\\s\\x0b&\\),<>\\|]|ef-|g(?:passwd|rp[\"']?[\\s\\x0b&\\),<>\\|])|pass)|l(?:ang\\+\\+|ippy-driver)|o(?:bc(?:[\"']?[\\s\\x0b&\\),<>\\|]|run)|mm[\"']?[\\s\\x0b&\\),<>\\|]|proc)|(?:p(?:an|io)|scli)[\"']?[\\s\\x0b&\\),<>\\|])|d(?:(?:iff|mesg|vips)[\"']?[\\s\\x0b&\\),<>\\|]|o(?:as[\"']?[\\s\\x0b&\\),<>\\|]|cker-)|pkg(?:-|[\"']?[\\s\\x0b&\\),<>\\|]))|e(?:2fsck|(?:fax|grep|macs|nd(?:if|sw)|sac|xpr)[\"']?[\\s\\x0b&\\),<>\\|])|f(?:d(?:(?:find|isk)[\"']?[\\s\\x0b&\\),<>\\|]|u?mount)|grep[\"']?[\\s\\x0b&\\),<>\\|]|iletest|ping(?:6|[\"']?[\\s\\x0b&\\),<>\\|])|tp(?:stats|who))|g(?:(?:core|insh|z(?:cat|exe|ip))[\"']?[\\s\\x0b&\\),<>\\|]|(?:etca|unzi)p|hc(?:-[\"']?[\\s\\x0b&\\),<>\\|]|i(?:-|[\"']?[\\s\\x0b&\\),<>\\|]))|r(?:(?:cat|ep)[\"']?[\\s\\x0b&\\),<>\\|]|oupmod))|(?:htop|jexec)[\"']?[\\s\\x0b&\\),<>\\|]|i(?:(?:conv|ftop)[\"']?[\\s\\x0b&\\),<>\\|]|pp(?:eveprinter|find|tool))|l(?:ast(?:comm|log(?:in)?)[\"']?[\\s\\x0b&\\),<>\\|]|ess(?:echo|(?:fil|pip)e)|ftp(?:[\"Line truncated
|
||||
"pattern": "(?i)(?:^(?:json\\.|\\x5c)?|b[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?u[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?s[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?y[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?b[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?o[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?x|(?:c[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?o[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?m[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?m[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?a[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?n[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?d|e[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?(?:n[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?v|v[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?a[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?l)|w[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?a[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?t[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?c[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?h)[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?[\"']?[\\s\\x0b&\\),<>\\|].*|[ls][\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?t[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?r[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?a[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?c[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?e|n[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?o[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?h[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?u[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?p|t[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?i[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?m[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?e[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?(?:[\"']?[\\s\\x0b&\\),<>\\|].*|o[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?u[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?t)|[\\n\\r;=`\\{]|\\|\\|?|&&?|\\$(?:\\(\\(?|[\\[\\{])|<(?:\\(|<<)|>\\(|\\([\\s\\x0b]*\\))[\\s\\x0b]*(?:[!\\$\\(\\{][\\s\\x0b]*|(?:[0-9A-Z_a-z]+=[^\\s\\x0b]+|\\$[0-9A-Z_a-z]+)[\\s\\x0b]+)*[\\s\\x0b]*[\"']*(?:[\"'-\\+\\--9\\?A-\\]_a-z\\|]+/)?[\"'\\x5c]*(?:a(?:ddgroup|nsible|pparmor_[^\\s\\x0b]{1,10}\\b|rj(?:-register|disp)|tobm[\"']?[\\s\\x0b&\\),<>\\|]|u(?:dit(?:2(?:allow|why)|ctl)|repor?t|search)|vcstat)|b(?:ase(?:32|64[\"']?[\\s\\x0b&\\),<>\\|]|nc)|(?:lkid|rwap|yobu)[\"']?[\\s\\x0b&\\),<>\\|]|sd(?:cat|iff|tar)|u(?:iltin|nzip2|sybox)|z(?:c(?:at|mp)[\"']?[\\s\\x0b&\\),<>\\|]|diff|e(?:grep|xe[\"']?[\\s\\x0b&\\),<>\\|])|f?grep|ip2(?:[\"']?[\\s\\x0b&\\),<>\\|]|recover)|less|more))|c(?:[89]9-gcc|argo-(?:audit|miri|watch)|h(?:(?:attr|c(?:at|on)|mod|o(?:om|wn)|sh)[\"']?[\\s\\x0b&\\),<>\\|]|e(?:ck(?:module|policy)|f-)|g(?:passwd|rp[\"']?[\\s\\x0b&\\),<>\\|])|pass)|l(?:ang\\+\\+|ippy-driver)|o(?:bc(?:[\"']?[\\s\\x0b&\\),<>\\|]|run)|mm[\"']?[\\s\\x0b&\\),<>\\|]|proc)|(?:p(?:an|io)|scli)[\"']?[\\s\\x0b&\\),<>\\|])|d(?:(?:iff|mesg|vips)[\"']?[\\s\\x0b&\\),<>\\|]|o(?:as[\"']?[\\s\\x0b&\\),<>\\|]|cker-)|pkg(?:-|[\"']?[\\s\\x0b&\\),<>\\|]))|e(?:2fsck|(?:fax|grep|macs|nd(?:if|sw)|sac|xpr)[\"']?[\\s\\x0b&\\),<>\\|])|f(?:d(?:(?:find|isk)[\"']?[\\s\\x0b&\\),<>\\|]|u?mount)|grep[\"']?[\\s\\x0b&\\),<>\\|]|i(?:letest|ndcon|xfiles[\"']?[\\s\\x0b&\\),<>\\|])|ping(?:6|[\"']?[\\s\\x0b&\\),<>\\|])|tp(?:stats|who))|g(?:(?:core|insh|z(?:cat|exe|ip))[\"']?[\\s\\x0b&\\),<>\\|]|e(?:nhomedircon|t(?:cap|enforce|sebool))|hc(?:-[\"']?[\\s\\x0b&\\),<>\\|]|i(?:-|[\"']?[\\s\\x0b&\\),<>\\|]))|r(?:(?:cat|ep|ubby)[\"']?[\\s\\x0b&\\),<>\\|]|oupmod)|unzip)|(?:htop|jexec)[\"']?[\\s\\x0b&\\),<>\\|]|i(?:(?:conv|ftopLine truncated
|
||||
"targets": [
|
||||
"all"
|
||||
],
|
||||
@@ -1028,6 +1028,27 @@
|
||||
],
|
||||
"paranoia_level": 1
|
||||
},
|
||||
{
|
||||
"id": "932180",
|
||||
"name": "Restricted File Upload Attempt",
|
||||
"pattern": "(?i)(?:\\b|^)(?:\\.(?:a(?:ddressbook|iignore|sh(?:_history|rc))|b(?:ashrc|o(?:to|werrc))|c(?:o(?:ndarc|verage)|(?:redential|v)s|sh(?:_history|rc)|ur(?:lrc|sorignore))|d(?:bshell|igrc|ocker(?:env|ignore))|e(?:ditorconfig|nv(?:rc)?|slint(?:ignore|rc))|f(?:bcindex|ish|orward|tpconfig)|g(?:emrc|it(?:(?:attribut|modul)es|config|ignore|keep)|oogle_authenticator)|h(?:gignore|t(?:access|digest|passwd))|i(?:dea|rb_history)|(?:jshint|offlineimap|yarn)rc|k(?:otlinc_history|sh(?:_history|rc))|l(?:esshst|ftprc|history|ighttpdpassword|ynx_cookies)|m(?:(?:bsync|smtp)rc|ys(?:cmserverinfo|ql_history))|n(?:ano(?:_history|rc)|(?:et|pm)rc|ode_repl_history|s(?:config|r))|p(?:ass(?:wd)?|e(?:arrc|rl(?:(?:_repl_)?history|db))|gpass|(?:hp|sql|ython)_history|inerc|lenv|r(?:ettierrc|o(?:c(?:log|mailrc)|file))|wd)|r(?:ediscli_history|h(?:istory|osts)|sync_exclude|ustup)|s(?:3cfg|creenrc|e(?:crets|lected_editor)|(?:h|ql(?:ite|plus))_history|vnignore)|t(?:csh(?:_history|rc)|erraformrc)|v(?:im(?:info|rc)|scode)|w(?:getrc|ww_?acl)|xauthority|z(?:history|sh(?:_history|env|rc)))|(?:Dockerfil|uptim)e|a(?:cpi|sound)|b(?:lock|ootconfig|uddyinfo)|c(?:(?:group|las|onsole)s|mdline|(?:puinf|rypt)o)|d(?:(?:evice|iskstat)s|(?:ock|riv)er|ynamic_debug)|execdomains|fi(?:(?:lesystem|sh_variable)s|rmware)|hypervisor|i(?:n(?:itial_root_password|terrupts)|o(?:mem|ports)|pmi)|k(?:allsyms|core|e(?:rnel|ys)|msg|page(?:c(?:group|ount)|flags))|l(?:atency_stats|o(?:adavg|cks))|m(?:dstat|eminfo|isc|o(?:dules?|unts)|trr)|p(?:a(?:getypeinfo|rtitions)|ower|ressure)|s(?:c(?:hed(?:_debug|stat)|si)|elf|labinfo|(?:oftirq|wap)s|slvpn_websession|tat|ysvipc)|timer_(?:list|stats)|v(?:ersion(?:_signature)?|m(?:allocinfo|stat))|zoneinfo)(?:[^0-9@-Z_a-z]|$)|\\.(?:a(?:(?:(?:cces|w)s|nydesk|tom|zure)/|ptitude/config)|b(?:ash_|(?:in|luemix)/|un(?:(?:dle)?/|fig\\.toml))|c(?:a(?:che/(?:notify-osd\\.log)?|rgo/)|(?:hocolatey|pan(?:el|plus)?|ups)/|o(?:nfig(?:\\.local\\.php|/)|veralls\\.yml))|d(?:(?:atadog-agent|bus|ocker|rush)/|eployment-secrets\\.txt)|(?:eclipse|i(?:bmcloud|(?:dle|rb)rc|pynb_checkpoints)|java|k(?:(?:aggl|ub)e|eras|onan)|v(?:agrant\\.d|i(?:dalia|m)|mware))/|g(?:(?:e(?:m|t(?:dns|mail))|ftp|n(?:ome(?:2|rc)?|upg)|radle|sutil)/|it(?:-credentials|/|lab-ci\\.yml))|h(?:g/|plip/hplip\\.conf)|l(?:(?:ftp|inode-cli|ocal/(?:bin|lib|s(?:har|tat)e))/|ldb-history)|m(?:(?:2|inikube)/|ongo(?:db/|shrc\\.js)|y(?:(?:login)?\\.cnf|py_cache/))|n(?:(?:ano|cftp|pm(?:-global)?|vm)/|ode-gyp)|o(?:ci/|h-my-|p(?:c/|en(?:ssl\\.cnf|vpn/)))|p(?:assword-store|g(?:_service\\.conf|admin/)|hp(?:_cs\\.dist|cs\\.xml(?:\\.dist)?)|(?:ip|(?:k|ulum)i|m2|ryrc|y(?:env|test_cache))/)|r(?:(?:benv|vm)/|e(?:dhat/|mote-sync\\.json)|ubocop\\.yml)|s(?:(?:(?:dkma|ubversio|v)n|ettings|nap|sh)/|ql\\.(?:(?:00|yz)1|[7bgx]?z|a(?:ce|rj)|cpio|l(?:ha|z)|(?:pe?|uh)a|r(?:0[0-9]|ar|ev)|t(?:a[rz]|[bgx]z))|tubby\\.yml)|t(?:(?:conn|hunderbird|o(?:ols|r))/|erraform(?:\\.(?:d/|lock\\.hcl)|/)|mux\\.conf|ravis\\.ya?ml)|u(?:nbound/|ser(?:\\.ini|min/))|w(?:eb\\.config\\.swp|get-hsts|(?:ine|p-cli)/)|yarnrc\\.yml)|/(?:\\.(?:DS_Store|ws_ftp\\.ini)|@(?:fs|id)/|(?:Web\\.confi|(?:debug|errors?)\\.lo)g|(?:auth|package(?:-lock|s)?)\\.json|composer\\.(?:json|lock)|(?:gruntfile|webpack\\.config)\\.js|npm-(?:debug\\.log|shrinkwrap\\.json)|yarn\\.lock)|(?:BlockCypher|yarn-(?:debug|error))\\.log|Desktop\\.ini|(?:META|WEB)-INF/|Thumbs\\.db|(?:aws(?:-key)?\\.ya?|user_secrets\\.y)ml|b(?:o(?:ot\\.ini|wer\\.json)|uild\\.zig\\.zon)|c(?:argo\\.toml|o(?:(?:mpose\\.ya?|verage\\.x)ml|nfig(?:[\\-_](?:dev|prod|sample|test)\\.(?:asp|ini|json|p(?:hp|[ly])|rb|t(?:oml|xt)|(?:x|ya?)ml)|\\.(?:asp|dev\\.(?:asp|ini|json|p(?:hp|[ly])|rb|t(?:oml|xt)|(?:x|ya?)ml)|fish|gz|in(?:c\\.php|i)|json|nu|p(?:hp|[ly]|rod\\.(?:asp|ini|json|p(?:hp|[ly])|rb|t(?:oml|xt)|(?:x|ya?)ml))|rb|sample\\.(?:asp|in(?:c\\.php|i)|json|p(?:hp|[ly])|rb|t(?:oml|xt)|(?:x|ya?)ml)|t(?:est\\.(?:asp|ini|json|p(?:hp|[ly])|rb|t(?:oml|xt)|(?:x|ya?)ml)|oml|xt)|(?:x|ya?)ml)))|redentials\\.json)|d(?:atabase\\.ya?ml|e(?:b(?:ian\\.cnf|ug\\.log)|fault(?:\\.settings|s\\.inc)\\.php))|env\\.php|ftp-sync\\.json|g(?:itlab(?:\\.rb|_config_)|o\\.(?:mod|sum))|key-users|l(?:dap-authentication-report\\.csv|o(?:cal\\.xm|gin\\.sq)l)|(?:my(?:sql(?:dump)?)?\\.cn|thread-sel)f|p(?:arameters\\.(?:php|yml)|hp(?:\\.ini|_errors?\\.log|cs\\.xml(?:\\.dist)?|info\\.php)|m2\\.log|y(?:project\\.toml|test\\.ini))|r(?:outing\\.yml|sync\\.log)|s(?:e(?:c(?:rets\\.(?:json|ya?ml)|urity\\.yml)|ndgrid\\.env|rvices\\.yml|t(?:tings\\.(?:(?:inc|local)\\.)?php|up\\.py))|ftp\\.json|ys(?:rq-trigger|tem\\.ini))|w(?:eblogic\\.xml|g-clients/|in\\.ini|p-config[\\-\\._])",
|
||||
"targets": [
|
||||
"filename"
|
||||
],
|
||||
"action": "block",
|
||||
"score": 10,
|
||||
"severity": "critical",
|
||||
"category": "rce",
|
||||
"enabled": true,
|
||||
"tags": [
|
||||
"attack-rce",
|
||||
"paranoia-level/1",
|
||||
"OWASP_CRS",
|
||||
"OWASP_CRS/ATTACK-RCE",
|
||||
"capec/1000/152/248/88"
|
||||
],
|
||||
"paranoia_level": 1
|
||||
},
|
||||
{
|
||||
"id": "932370",
|
||||
"name": "Remote Command Execution: Windows Command Injection",
|
||||
@@ -1052,7 +1073,7 @@
|
||||
{
|
||||
"id": "932380",
|
||||
"name": "Remote Command Execution: Windows Command Injection",
|
||||
"pattern": "(?i)(?:[\\n\\r;`\\{]|\\|\\|?|&&?)[\\s\\x0b]*[\\s\\x0b\"'\\(,@]*(?:[\"'\\.-9A-Z_a-z]+/|(?:[\"'\\x5c\\^]*[0-9A-Z_a-z][\"'\\x5c\\^]*:[^\\x5c]*|[ \"'\\.-9A-Z\\x5c\\^_a-z]*)\\x5c)?[\"\\^]*(?:a[\"\\^]*(?:s[\"\\^]*s[\"\\^]*o[\"\\^]*c|t[\"\\^]*(?:m[\"\\^]*a[\"\\^]*d[\"\\^]*m|t[\"\\^]*r[\"\\^]*i[\"\\^]*b)|u[\"\\^]*(?:d[\"\\^]*i[\"\\^]*t[\"\\^]*p[\"\\^]*o[\"\\^]*l|t[\"\\^]*o[\"\\^]*(?:c[\"\\^]*(?:h[\"\\^]*k|o[\"\\^]*n[\"\\^]*v)|(?:f[\"\\^]*m|m[\"\\^]*o[\"\\^]*u[\"\\^]*n)[\"\\^]*t)))|b[\"\\^]*(?:c[\"\\^]*d[\"\\^]*(?:b[\"\\^]*o[\"\\^]*o|e[\"\\^]*d[\"\\^]*i)[\"\\^]*t|(?:d[\"\\^]*e[\"\\^]*h[\"\\^]*d|o[\"\\^]*o[\"\\^]*t)[\"\\^]*c[\"\\^]*f[\"\\^]*g|i[\"\\^]*t[\"\\^]*s[\"\\^]*a[\"\\^]*d[\"\\^]*m[\"\\^]*i[\"\\^]*n)|c[\"\\^]*(?:a[\"\\^]*c[\"\\^]*l[\"\\^]*s|e[\"\\^]*r[\"\\^]*t[\"\\^]*(?:r[\"\\^]*e[\"\\^]*q|u[\"\\^]*t[\"\\^]*i[\"\\^]*l)|h[\"\\^]*(?:c[\"\\^]*p|d[\"\\^]*i[\"\\^]*r|g[\"\\^]*(?:l[\"\\^]*o[\"\\^]*g[\"\\^]*o[\"\\^]*n|p[\"\\^]*o[\"\\^]*r[\"\\^]*t|u[\"\\^]*s[\"\\^]*r)|k[\"\\^]*(?:d[\"\\^]*s[\"\\^]*k|n[\"\\^]*t[\"\\^]*f[\"\\^]*s))|l[\"\\^]*e[\"\\^]*a[\"\\^]*n[\"\\^]*m[\"\\^]*g[\"\\^]*r|m[\"\\^]*(?:d(?:[\"\\^]*k[\"\\^]*e[\"\\^]*y)?|s[\"\\^]*t[\"\\^]*p)|s[\"\\^]*c[\"\\^]*r[\"\\^]*i[\"\\^]*p[\"\\^]*t)|d[\"\\^]*(?:c[\"\\^]*(?:d[\"\\^]*i[\"\\^]*a[\"\\^]*g|g[\"\\^]*p[\"\\^]*o[\"\\^]*f[\"\\^]*i[\"\\^]*x)|e[\"\\^]*(?:f[\"\\^]*r[\"\\^]*a[\"\\^]*g|l)|f[\"\\^]*s[\"\\^]*(?:d[\"\\^]*i[\"\\^]*a|r[\"\\^]*m[\"\\^]*i)[\"\\^]*g|i[\"\\^]*(?:a[\"\\^]*n[\"\\^]*t[\"\\^]*z|r|s[\"\\^]*(?:k[\"\\^]*(?:c[\"\\^]*o[\"\\^]*(?:m[\"\\^]*p|p[\"\\^]*y)|p[\"\\^]*(?:a[\"\\^]*r[\"\\^]*t|e[\"\\^]*r[\"\\^]*f)|r[\"\\^]*a[\"\\^]*i[\"\\^]*d|s[\"\\^]*h[\"\\^]*a[\"\\^]*d[\"\\^]*o[\"\\^]*w)|p[\"\\^]*d[\"\\^]*i[\"\\^]*a[\"\\^]*g))|n[\"\\^]*s[\"\\^]*c[\"\\^]*m[\"\\^]*d|(?:o[\"\\^]*s[\"\\^]*k[\"\\^]*e|r[\"\\^]*i[\"\\^]*v[\"\\^]*e[\"\\^]*r[\"\\^]*q[\"\\^]*u[\"\\^]*e[\"\\^]*r)[\"\\^]*y)|e[\"\\^]*(?:n[\"\\^]*d[\"\\^]*l[\"\\^]*o[\"\\^]*c[\"\\^]*a[\"\\^]*l|v[\"\\^]*e[\"\\^]*n[\"\\^]*t[\"\\^]*c[\"\\^]*r[\"\\^]*e[\"\\^]*a[\"\\^]*t[\"\\^]*e)|E[\"\\^]*v[\"\\^]*n[\"\\^]*t[\"\\^]*c[\"\\^]*m[\"\\^]*d|f[\"\\^]*(?:c|i[\"\\^]*(?:l[\"\\^]*e[\"\\^]*s[\"\\^]*y[\"\\^]*s[\"\\^]*t[\"\\^]*e[\"\\^]*m[\"\\^]*s|n[\"\\^]*d[\"\\^]*s[\"\\^]*t[\"\\^]*r)|l[\"\\^]*a[\"\\^]*t[\"\\^]*t[\"\\^]*e[\"\\^]*m[\"\\^]*p|o[\"\\^]*r[\"\\^]*f[\"\\^]*i[\"\\^]*l[\"\\^]*e[\"\\^]*s|r[\"\\^]*e[\"\\^]*e[\"\\^]*d[\"\\^]*i[\"\\^]*s[\"\\^]*k|s[\"\\^]*u[\"\\^]*t[\"\\^]*i[\"\\^]*l|(?:t[\"\\^]*y[\"\\^]*p|v[\"\\^]*e[\"\\^]*u[\"\\^]*p[\"\\^]*d[\"\\^]*a[\"\\^]*t)[\"\\^]*e)|g[\"\\^]*(?:e[\"\\^]*t[\"\\^]*(?:m[\"\\^]*a[\"\\^]*c|t[\"\\^]*y[\"\\^]*p[\"\\^]*e)|o[\"\\^]*t[\"\\^]*o|p[\"\\^]*(?:f[\"\\^]*i[\"\\^]*x[\"\\^]*u[\"\\^]*p|(?:r[\"\\^]*e[\"\\^]*s[\"\\^]*u[\"\\^]*l[\"\\^]*)?t|u[\"\\^]*p[\"\\^]*d[\"\\^]*a[\"\\^]*t[\"\\^]*e)|r[\"\\^]*a[\"\\^]*f[\"\\^]*t[\"\\^]*a[\"\\^]*b[\"\\^]*l)|h[\"\\^]*(?:e[\"\\^]*l[\"\\^]*p[\"\\^]*c[\"\\^]*t[\"\\^]*r|o[\"\\^]*s[\"\\^]*t[\"\\^]*n[\"\\^]*a[\"\\^]*m[\"\\^]*e)|i[\"\\^]*(?:c[\"\\^]*a[\"\\^]*c[\"\\^]*l[\"\\^]*s|p[\"\\^]*(?:c[\"\\^]*o[\"\\^]*n[\"\\^]*f[\"\\^]*i[\"\\^]*g|x[\"\\^]*r[\"\\^]*o[\"\\^]*u[\"\\^]*t[\"\\^]*e)|r[\"\\^]*f[\"\\^]*t[\"\\^]*p)|j[\"\\^]*e[\"\\^]*t[\"\\^]*p[\"\\^]*a[\"\\^]*c[\"\\^]*k|k[\"\\^]*(?:l[\"\\^]*i[\"\\^]*s[\"\\^]*t|s[\"\\^]*e[\"\\^]*t[\"\\^]*u[\"\\^]*p|t[\"\\^]*(?:m[\"\\^]*u[\"\\^]*t[\"\\^]*i[\"\\^]*l|p[\"\\^]*a[\"\\^]*s[\"\\^]*s))|l[\"\\^]*(?:o[\"\\^]*(?:d[\"\\^]*c[\"\\^]*t[\"\\^]*r|g[\"\\^]*(?:m[\"\\^]*a[\"\\^]*n|o[\"\\^]*f[\"\\^]*f))|p[\"\\^]*[qr])|m[\"\\^]*(?:a[\"\\^]*(?:c[\"\\^]*f[\"\\^]*i[\"\\^]*l[\"\\^]*e|k[\"\\^]*e[\"\\^]*c[\"\\^]*a[\"\\^]*b|p[\"\\^]*a[\"\\^]*d[\"\\^]*m[\"\\^]*i[\"\\^]*n)|k[\"\\^]*(?:d[\"\\^]*i[\"\\^]*r|l[\"\\^]*i[\"\\^]*n[\"\\^]*k)|m[\"\\^]*c|o[\"\\^]*u[\"\\^]*n[\"\\^]*t[\"\\^]*v[\"\\^]*o[\"\\^]*l|q[\"\\^]*(?:b[\"\\^]*k[\"\\^]*u[\"\\^]*p|(?:t[\"\\^]*g[\"\\^]*)?s[\"\\^]*v[\"\\^]*c)|s[\"\\^]*(?:d[\"\\^]*t|i[\"\\^]*(?:e[\"\\^]*x[\"\\^]*e[\"\\^]*c|n[\"\\^]*f[\"\\^]*o[\"\\^]*3[\"\\^]*2)|t[\"\\^]*s[\"\\^]*c))|n[\"\\^]*(?:b[\"\\^]*t[\"\\^]*s[\"\\^]*t[\"\\^]*a[\"\\^]*t|e[\"\\^]*t[\"\\^]*(?:c[\"\\^]*f[\"\\^]*g|d[\"\\^]*o[\"\\^]*m|s[\"\\^]*(?:h|t[\"\\^]*a[\"\\^]*t))|f[\"\\^]*s[\"\\^]*(?:a[\"\\^]*d[\"\\^]*m[\"\\^]*i[\"\\^]*n|s[\"\\^]*(?:h[\"\\^]*a[\"\\^]*r[\"\\^]*e|t[\"\\^]*a[\"\\^]*t))|l[\"\\^]*(?:b[\"\\^]*m[\"\\^]*g[\"\\^]*r|t[\"\\^]*e[\"\\^]*s[\"\\^]*t)|s[\"\\^]*l[\"\\^]*o[\"\\^]*o[\"\\^]*k[\"\\^]*u[\"\\^]*p|t[\"\\^]*(?:b[\"\\^]*a[\"\\^]*c[\"\\^]*k[\"\\^]*u[\"\\^]*p|c[\"\\^]*m[\"\\^]*d[\"\\^]*p[\"\\^]*r[\"\\^]*o[\"\\^]*m[\"\\^]*p[\"\\^]*t|f[\"\\^]*r[\"\\^]*s[\"\\^]*u[\"\\^]*t[\"\\^]*l))|o[\"\\^]*(?:f[\"\\^]*f[\"\\^]*l[\"\\^]*i[\"\\^]*n[\"\\^]*e|p[\"\\^]*e[\"\\^]*n[\"\\^]*f[\"\\^]*i[\"\\^]*l[\"\\^]*e[\"\\^]*s)|p[\"\\^]*(?:a[\"\\^]*(?:g[\"\\^]*e[\"\\^]*f[\"\\^]*i[\"\\^]*l[\"\\^]*e[\"\\^]*c[\"\\^]*o[\"\\^]*n[\"\\^]*f[\"\\^]*i|t[\"\\^]*h[\"\\^]*p[\"\\^]*i[\"\\^]*n)[\"\\^]*g|(?:b[\"\\^]*a[\"\\^]*d[\"\\^]*m[\"\\^]*i|k[\"\\^]*t[\"\\^]*m[\"\\^]*o)[\"\\^]*n|e[\"\\^]*(?:n[\"\\^]*t[\"\\^]*n[\"\\^]*t|r[\"\\^]*f[\"\\^]*m[\"\\^]*o[\"\\^]*n)|n[\Line truncated
|
||||
"pattern": "(?i)(?:[\\n\\r;`\\{]|\\|\\|?|&&?)[\\s\\x0b]*[\\s\\x0b\"'\\(,@]*(?:[\"'\\.-9A-Z_a-z]+/|(?:[\"'\\x5c\\^]*[0-9A-Z_a-z][\"'\\x5c\\^]*:[^\\x5c]*|[ \"'\\.-9A-Z\\x5c\\^_a-z]*)\\x5c)?[\"\\^]*(?:a[\"\\^]*(?:s[\"\\^]*s[\"\\^]*o[\"\\^]*c|t[\"\\^]*(?:m[\"\\^]*a[\"\\^]*d[\"\\^]*m|t[\"\\^]*r[\"\\^]*i[\"\\^]*b)|u[\"\\^]*(?:d[\"\\^]*i[\"\\^]*t[\"\\^]*p[\"\\^]*o[\"\\^]*l|t[\"\\^]*o[\"\\^]*(?:c[\"\\^]*(?:h[\"\\^]*k|o[\"\\^]*n[\"\\^]*v)|(?:f[\"\\^]*m|m[\"\\^]*o[\"\\^]*u[\"\\^]*n)[\"\\^]*t)))|b[\"\\^]*(?:c[\"\\^]*d[\"\\^]*(?:b[\"\\^]*o[\"\\^]*o|e[\"\\^]*d[\"\\^]*i)[\"\\^]*t|(?:d[\"\\^]*e[\"\\^]*h[\"\\^]*d|o[\"\\^]*o[\"\\^]*t)[\"\\^]*c[\"\\^]*f[\"\\^]*g|i[\"\\^]*t[\"\\^]*s[\"\\^]*a[\"\\^]*d[\"\\^]*m[\"\\^]*i[\"\\^]*n)|c[\"\\^]*(?:a[\"\\^]*c[\"\\^]*l[\"\\^]*s|e[\"\\^]*r[\"\\^]*t[\"\\^]*(?:r[\"\\^]*e[\"\\^]*q|u[\"\\^]*t[\"\\^]*i[\"\\^]*l)|h[\"\\^]*(?:c[\"\\^]*p|d[\"\\^]*i[\"\\^]*r|g[\"\\^]*(?:l[\"\\^]*o[\"\\^]*g[\"\\^]*o[\"\\^]*n|p[\"\\^]*o[\"\\^]*r[\"\\^]*t|u[\"\\^]*s[\"\\^]*r)|k[\"\\^]*(?:d[\"\\^]*s[\"\\^]*k|n[\"\\^]*t[\"\\^]*f[\"\\^]*s))|l[\"\\^]*e[\"\\^]*a[\"\\^]*n[\"\\^]*m[\"\\^]*g[\"\\^]*r|m[\"\\^]*(?:d(?:[\"\\^]*k[\"\\^]*e[\"\\^]*y)?|s[\"\\^]*t[\"\\^]*p)|s[\"\\^]*(?:c[\"\\^]*r[\"\\^]*i[\"\\^]*p[\"\\^]*t|v[\"\\^]*d[\"\\^]*e))|d[\"\\^]*(?:c[\"\\^]*(?:d[\"\\^]*i[\"\\^]*a[\"\\^]*g|g[\"\\^]*p[\"\\^]*o[\"\\^]*f[\"\\^]*i[\"\\^]*x)|e[\"\\^]*(?:f[\"\\^]*r[\"\\^]*a[\"\\^]*g|l)|f[\"\\^]*s[\"\\^]*(?:d[\"\\^]*i[\"\\^]*a|r[\"\\^]*m[\"\\^]*i)[\"\\^]*g|i[\"\\^]*(?:a[\"\\^]*n[\"\\^]*t[\"\\^]*z|r|s[\"\\^]*(?:k[\"\\^]*(?:c[\"\\^]*o[\"\\^]*(?:m[\"\\^]*p|p[\"\\^]*y)|p[\"\\^]*(?:a[\"\\^]*r[\"\\^]*t|e[\"\\^]*r[\"\\^]*f)|r[\"\\^]*a[\"\\^]*i[\"\\^]*d|s[\"\\^]*h[\"\\^]*a[\"\\^]*d[\"\\^]*o[\"\\^]*w)|p[\"\\^]*d[\"\\^]*i[\"\\^]*a[\"\\^]*g))|n[\"\\^]*s[\"\\^]*c[\"\\^]*m[\"\\^]*d|(?:o[\"\\^]*s[\"\\^]*k[\"\\^]*e|r[\"\\^]*i[\"\\^]*v[\"\\^]*e[\"\\^]*r[\"\\^]*q[\"\\^]*u[\"\\^]*e[\"\\^]*r)[\"\\^]*y|s[\"\\^]*(?:a[\"\\^]*(?:c[\"\\^]*l[\"\\^]*s|d[\"\\^]*d)|g[\"\\^]*e[\"\\^]*t|m[\"\\^]*(?:g[\"\\^]*m[\"\\^]*t|o[\"\\^]*(?:d|v[\"\\^]*e))|q[\"\\^]*u[\"\\^]*e[\"\\^]*r[\"\\^]*y|r[\"\\^]*m))|e[\"\\^]*(?:n[\"\\^]*d[\"\\^]*l[\"\\^]*o[\"\\^]*c[\"\\^]*a[\"\\^]*l|v[\"\\^]*e[\"\\^]*n[\"\\^]*t[\"\\^]*c[\"\\^]*r[\"\\^]*e[\"\\^]*a[\"\\^]*t[\"\\^]*e)|E[\"\\^]*v[\"\\^]*n[\"\\^]*t[\"\\^]*c[\"\\^]*m[\"\\^]*d|f[\"\\^]*(?:c|i[\"\\^]*(?:l[\"\\^]*e[\"\\^]*s[\"\\^]*y[\"\\^]*s[\"\\^]*t[\"\\^]*e[\"\\^]*m[\"\\^]*s|n[\"\\^]*d[\"\\^]*s[\"\\^]*t[\"\\^]*r)|l[\"\\^]*a[\"\\^]*t[\"\\^]*t[\"\\^]*e[\"\\^]*m[\"\\^]*p|o[\"\\^]*r[\"\\^]*f[\"\\^]*i[\"\\^]*l[\"\\^]*e[\"\\^]*s|r[\"\\^]*e[\"\\^]*e[\"\\^]*d[\"\\^]*i[\"\\^]*s[\"\\^]*k|s[\"\\^]*u[\"\\^]*t[\"\\^]*i[\"\\^]*l|(?:t[\"\\^]*y[\"\\^]*p|v[\"\\^]*e[\"\\^]*u[\"\\^]*p[\"\\^]*d[\"\\^]*a[\"\\^]*t)[\"\\^]*e)|g[\"\\^]*(?:e[\"\\^]*t[\"\\^]*(?:m[\"\\^]*a[\"\\^]*c|t[\"\\^]*y[\"\\^]*p[\"\\^]*e)|o[\"\\^]*t[\"\\^]*o|p[\"\\^]*(?:f[\"\\^]*i[\"\\^]*x[\"\\^]*u[\"\\^]*p|(?:r[\"\\^]*e[\"\\^]*s[\"\\^]*u[\"\\^]*l[\"\\^]*)?t|u[\"\\^]*p[\"\\^]*d[\"\\^]*a[\"\\^]*t[\"\\^]*e)|r[\"\\^]*a[\"\\^]*f[\"\\^]*t[\"\\^]*a[\"\\^]*b[\"\\^]*l)|h[\"\\^]*(?:e[\"\\^]*l[\"\\^]*p[\"\\^]*c[\"\\^]*t[\"\\^]*r|o[\"\\^]*s[\"\\^]*t[\"\\^]*n[\"\\^]*a[\"\\^]*m[\"\\^]*e)|i[\"\\^]*(?:c[\"\\^]*a[\"\\^]*c[\"\\^]*l[\"\\^]*s|p[\"\\^]*(?:c[\"\\^]*o[\"\\^]*n[\"\\^]*f[\"\\^]*i[\"\\^]*g|x[\"\\^]*r[\"\\^]*o[\"\\^]*u[\"\\^]*t[\"\\^]*e)|r[\"\\^]*f[\"\\^]*t[\"\\^]*p)|j[\"\\^]*e[\"\\^]*t[\"\\^]*p[\"\\^]*a[\"\\^]*c[\"\\^]*k|k[\"\\^]*(?:l[\"\\^]*i[\"\\^]*s[\"\\^]*t|s[\"\\^]*e[\"\\^]*t[\"\\^]*u[\"\\^]*p|t[\"\\^]*(?:m[\"\\^]*u[\"\\^]*t[\"\\^]*i[\"\\^]*l|p[\"\\^]*a[\"\\^]*s[\"\\^]*s))|l[\"\\^]*(?:d[\"\\^]*i[\"\\^]*f[\"\\^]*d[\"\\^]*e|o[\"\\^]*(?:d[\"\\^]*c[\"\\^]*t[\"\\^]*r|g[\"\\^]*(?:m[\"\\^]*a[\"\\^]*n|o[\"\\^]*f[\"\\^]*f))|p[\"\\^]*[qr])|m[\"\\^]*(?:a[\"\\^]*(?:c[\"\\^]*f[\"\\^]*i[\"\\^]*l[\"\\^]*e|k[\"\\^]*e[\"\\^]*c[\"\\^]*a[\"\\^]*b|p[\"\\^]*a[\"\\^]*d[\"\\^]*m[\"\\^]*i[\"\\^]*n)|k[\"\\^]*(?:d[\"\\^]*i[\"\\^]*r|l[\"\\^]*i[\"\\^]*n[\"\\^]*k)|m[\"\\^]*c|o[\"\\^]*u[\"\\^]*n[\"\\^]*t[\"\\^]*v[\"\\^]*o[\"\\^]*l|q[\"\\^]*(?:b[\"\\^]*k[\"\\^]*u[\"\\^]*p|(?:t[\"\\^]*g[\"\\^]*)?s[\"\\^]*v[\"\\^]*c)|s[\"\\^]*(?:d[\"\\^]*t|i[\"\\^]*(?:e[\"\\^]*x[\"\\^]*e[\"\\^]*c|n[\"\\^]*f[\"\\^]*o[\"\\^]*3[\"\\^]*2)|t[\"\\^]*s[\"\\^]*c))|n[\"\\^]*(?:b[\"\\^]*t[\"\\^]*s[\"\\^]*t[\"\\^]*a[\"\\^]*t|e[\"\\^]*t[\"\\^]*(?:c[\"\\^]*f[\"\\^]*g|d[\"\\^]*o[\"\\^]*m|s[\"\\^]*(?:h|t[\"\\^]*a[\"\\^]*t))|f[\"\\^]*s[\"\\^]*(?:a[\"\\^]*d[\"\\^]*m[\"\\^]*i[\"\\^]*n|s[\"\\^]*(?:h[\"\\^]*a[\"\\^]*r[\"\\^]*e|t[\"\\^]*a[\"\\^]*t))|l[\"\\^]*(?:b[\"\\^]*m[\"\\^]*g[\"\\^]*r|t[\"\\^]*e[\"\\^]*s[\"\\^]*t)|s[\"\\^]*l[\"\\^]*o[\"\\^]*o[\"\\^]*k[\"\\^]*u[\"\\^]*p|t[\"\\^]*(?:b[\"\\^]*a[\"\\^]*c[\"\\^]*k[\"\\^]*u[\"\\^]*p|c[\"\\^]*m[\"\\^]*d[\"\\^]*p[\"\\^]*r[\"\\^]*o[\"\\^]*m[\"\\^]*p[\"\\^]*t|(?:d[\"\\^]*s[\"\\^]*u[\"\\^]*t[\"\\^]*i|f[\"\\^]*r[\"\\^]*s[\"\\^]*u[\"\\^]*t)[\"\\^]*l))|o[\"\\^]*(?:f[\"\\^]*f[\"\\^]*l[\"\\^]*i[\"\\^]*n[\"\\^]*e|p[\"\\^]*e[\"\\^]*n[\"\\^]*f[\"\\^]*i[\"\\^]*l[\"\\^]*e[\"\\^]*s)|p[\"\\^]*(?:a[\"\\^]*(?:g[\"\\^]*e[\"\Line truncated
|
||||
"targets": [
|
||||
"all"
|
||||
],
|
||||
@@ -1283,7 +1304,7 @@
|
||||
{
|
||||
"id": "932236",
|
||||
"name": "Remote Command Execution: Unix Command Injection (command without evasion)",
|
||||
"pattern": "(?i)(?:^(?:json\\.|\\x5c)?|b[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?u[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?s[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?y[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?b[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?o[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?x|(?:c[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?o[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?m[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?m[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?a[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?n[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?d|e[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?(?:n[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?v|v[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?a[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?l)|w[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?a[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?t[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?c[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?h)[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?[\"']?[\\s\\x0b&\\),<>\\|].*|[ls][\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?t[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?r[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?a[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?c[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?e|n[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?o[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?h[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?u[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?p|t[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?i[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?m[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?e[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?(?:[\"']?[\\s\\x0b&\\),<>\\|].*|o[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?u[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?t)|[\\n\\r;=`\\{]|\\|\\|?|&&?|\\$(?:\\(\\(?|[\\[\\{])|<(?:\\(|<<)|>\\(|\\([\\s\\x0b]*\\))[\\s\\x0b]*(?:[!\\$\\(\\{][\\s\\x0b]*|(?:[0-9A-Z_a-z]+=[^\\s\\x0b]+|\\$[0-9A-Z_a-z]+)[\\s\\x0b]+)*[\\s\\x0b]*[\"']*(?:[\"'-\\+\\--9\\?A-\\]_a-z\\|]+/)?[\"'\\x5c]*(?:(?:7z[arx]?|(?:GE|POS)T|y(?:e(?:s|lp)|um|arn)|HEAD)[\"']?[\\s\\x0b&\\),<>\\|]|a(?:a-[^\\s\\x0b]{1,10}\\b|(?:b|w[ks]|l(?:ias|pine)|tobm|xel)[\"']?[\\s\\x0b&\\),<>\\|]|p(?:t(?:[\"']?[\\s\\x0b&\\),<>\\|]|-get)|parmor_[^\\s\\x0b]{1,10}\\b)|r(?:(?:p|ch)?[\"']?[\\s\\x0b&\\),<>\\|]|j(?:[\"']?[\\s\\x0b&\\),<>\\|]|-register|disp)|ia2c)|s(?:h[\"']?[\\s\\x0b&\\),<>\\|]|cii(?:-xfr|85)|pell)|dd(?:group|user)|getty|nsible|u(?:ditctl|repot|search))|b(?:z(?:(?:z|c(?:at|mp))[\"']?[\\s\\x0b&\\),<>\\|]|diff|e(?:grep|xe[\"']?[\\s\\x0b&\\),<>\\|])|f?grep|ip2(?:[\"']?[\\s\\x0b&\\),<>\\|]|recover)|less|more)|a(?:s(?:e(?:32|64[\"']?[\\s\\x0b&\\),<>\\|]|n(?:ame[\"']?[\\s\\x0b&\\),<>\\|]|c))|h[\"']?[\\s\\x0b&\\),<>\\|])|tch[\"']?[\\s\\x0b&\\),<>\\|])|lkid[\"']?[\\s\\x0b&\\),<>\\|]|pftrace|r(?:eaksw|(?:idge|wap)[\"']?[\\s\\x0b&\\),<>\\|])|sd(?:cat|iff|tar)|u(?:iltin|n(?:dler[\"']?[\\s\\x0b&\\),<>\\|]|zip2)|s(?:ctl|ybox))|y(?:ebug|obu[\"']?[\\s\\x0b&\\),<>\\|]))|c(?:[89]9(?:[\"']?[\\s\\x0b&\\),<>\\|]|-gcc)|a(?:(?:t|ncel|psh)[\"']?[\\s\\x0b&\\),<>\\|]|rgo(?:-(?:audit|miri|watch)|[\"']?[\\s\\x0b&\\),<>\\|]))|(?:c|mp)[\"']?[\\s\\x0b&\\),<>\\|]|p(?:(?:an|io)?[\"']?[\\s\\x0b&\\),<>\\|]|ulimit)|s(?:(?:h|cli)[\"']?[\\s\\x0b&\\),<>\\|]|plit|vtool)|u(?:(?:t|rl)[\"']?[\\s\\x0b&\\),<>\\|]|psfilter)|ertbot|h(?:(?:(?:att|di)r|mod|o(?:om|wn)|root|sh)[\"']?[\\s\\x0b&\\),<>\\|]|e(?:ck_(?:by_ssh|cups|log|memory|raid|s(?:sl_cert|tatusfile))|f(?:-|[\"']?[\\s\\x0b&\\)Line truncated
|
||||
"pattern": "(?i)(?:^(?:json\\.|\\x5c)?|b[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?u[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?s[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?y[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?b[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?o[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?x|(?:c[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?o[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?m[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?m[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?a[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?n[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?d|e[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?(?:n[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?v|v[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?a[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?l)|w[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?a[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?t[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?c[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?h)[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?[\"']?[\\s\\x0b&\\),<>\\|].*|[ls][\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?t[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?r[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?a[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?c[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?e|n[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?o[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?h[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?u[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?p|t[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?i[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?m[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?e[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?(?:[\"']?[\\s\\x0b&\\),<>\\|].*|o[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?u[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?t)|[\\n\\r;=`\\{]|\\|\\|?|&&?|\\$(?:\\(\\(?|[\\[\\{])|<(?:\\(|<<)|>\\(|\\([\\s\\x0b]*\\))[\\s\\x0b]*(?:[!\\$\\(\\{][\\s\\x0b]*|(?:[0-9A-Z_a-z]+=[^\\s\\x0b]+|\\$[0-9A-Z_a-z]+)[\\s\\x0b]+)*[\\s\\x0b]*[\"']*(?:[\"'-\\+\\--9\\?A-\\]_a-z\\|]+/)?[\"'\\x5c]*(?:(?:7z[arx]?|(?:GE|POS)T|y(?:e(?:s|lp)|um|arn)|HEAD)[\"']?[\\s\\x0b&\\),<>\\|]|a(?:a-[^\\s\\x0b]{1,10}\\b|(?:b|w[ks]|l(?:ias|pine)|tobm|xel)[\"']?[\\s\\x0b&\\),<>\\|]|p(?:t(?:[\"']?[\\s\\x0b&\\),<>\\|]|-get)|parmor_[^\\s\\x0b]{1,10}\\b)|r(?:(?:p|ch)?[\"']?[\\s\\x0b&\\),<>\\|]|j(?:[\"']?[\\s\\x0b&\\),<>\\|]|-register|disp)|ia2c)|s(?:h[\"']?[\\s\\x0b&\\),<>\\|]|cii(?:-xfr|85)|pell)|dd(?:group|user)|getty|nsible|u(?:dit(?:2(?:allow|why)|ctl)|repor?t|search)|vcstat)|b(?:z(?:(?:z|c(?:at|mp))[\"']?[\\s\\x0b&\\),<>\\|]|diff|e(?:grep|xe[\"']?[\\s\\x0b&\\),<>\\|])|f?grep|ip2(?:[\"']?[\\s\\x0b&\\),<>\\|]|recover)|less|more)|a(?:s(?:e(?:32|64[\"']?[\\s\\x0b&\\),<>\\|]|n(?:ame[\"']?[\\s\\x0b&\\),<>\\|]|c))|h[\"']?[\\s\\x0b&\\),<>\\|])|tch[\"']?[\\s\\x0b&\\),<>\\|])|lkid[\"']?[\\s\\x0b&\\),<>\\|]|pftrace|r(?:eaksw|(?:idge|wap)[\"']?[\\s\\x0b&\\),<>\\|])|sd(?:cat|iff|tar)|u(?:iltin|n(?:dler[\"']?[\\s\\x0b&\\),<>\\|]|zip2)|s(?:ctl|ybox))|y(?:ebug|obu[\"']?[\\s\\x0b&\\),<>\\|]))|c(?:[89]9(?:[\"']?[\\s\\x0b&\\),<>\\|]|-gcc)|a(?:(?:t|ncel|psh)[\"']?[\\s\\x0b&\\),<>\\|]|rgo(?:-(?:audit|miri|watch)|[\"']?[\\s\\x0b&\\),<>\\|]))|(?:c|mp)[\"']?[\\s\\x0b&\\),<>\\|]|p(?:(?:an|io)?[\"']?[\\s\\x0b&\\),<>\\|]|ulimit)|s(?:(?:h|cli)[\"']?[\\s\\x0b&\\),<>\\|]|plit|vtool)|u(?:(?:t|rl)[\"']?[\\s\\x0b&\\),<>\\|]|psfilter)|ertbot|h(?:(?:(?:att|di)r|c(?:at|on)|mod|o(?:om|wn)|root|sh)[\"']?[\\s\\x0b&\\),<>\\|]|e(?:ck(?:_(?:by_ssh|cups|log|memory|raid|s(?:sl_Line truncated
|
||||
"targets": [
|
||||
"all"
|
||||
],
|
||||
@@ -1304,8 +1325,9 @@
|
||||
{
|
||||
"id": "932239",
|
||||
"name": "Remote Command Execution: Unix Command Injection found in user-agent or referer header",
|
||||
"pattern": "(?i)(?:^(?:json\\.|\\x5c)?|b[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?u[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?s[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?y[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?b[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?o[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?x|(?:c[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?o[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?m[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?m[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?a[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?n[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?d|e[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?(?:n[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?v|v[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?a[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?l)|w[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?a[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?t[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?c[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?h)[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?[\"']?[\\s\\x0b&\\),<>\\|].*|[ls][\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?t[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?r[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?a[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?c[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?e|n[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?o[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?h[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?u[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?p|t[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?i[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?m[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?e[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?(?:[\"']?[\\s\\x0b&\\),<>\\|].*|o[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?u[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?t)|[\\n\\r;=`\\{]|\\|\\|?|&&?|\\$(?:\\(\\(?|[\\[\\{])|<(?:\\(|<<)|>\\(|\\([\\s\\x0b]*\\))[\\s\\x0b]*(?:[!\\$\\(\\{][\\s\\x0b]*|(?:[0-9A-Z_a-z]+=[^\\s\\x0b]+|\\$[0-9A-Z_a-z]+)[\\s\\x0b]+)*[\\s\\x0b]*[\"']*(?:[\"'-\\+\\--9\\?A-\\]_a-z\\|]+/)?[\"'\\x5c]*(?:(?:7z[arx]?|(?:GE|POS)T|y(?:e(?:s|lp)|um|arn)|HEAD)[\"']?[\\s\\x0b&\\),<>\\|]|a(?:a-[^\\s\\x0b]{1,10}\\b|(?:b|w[ks]|l(?:ias|pine)|tobm|xel)[\"']?[\\s\\x0b&\\),<>\\|]|p(?:t(?:[\"']?[\\s\\x0b&\\),<>\\|]|-get)|parmor_[^\\s\\x0b]{1,10}\\b)|r(?:(?:p|ch)?[\"']?[\\s\\x0b&\\),<>\\|]|j(?:[\"']?[\\s\\x0b&\\),<>\\|]|-register|disp)|ia2c)|s(?:h[\"']?[\\s\\x0b&\\),<>\\|]|cii(?:-xfr|85)|pell)|dd(?:group|user)|getty|nsible|u(?:ditctl|repot|search))|b(?:z(?:(?:z|c(?:at|mp))[\"']?[\\s\\x0b&\\),<>\\|]|diff|e(?:grep|xe[\"']?[\\s\\x0b&\\),<>\\|])|f?grep|ip2(?:[\"']?[\\s\\x0b&\\),<>\\|]|recover)|less|more)|a(?:s(?:e(?:32|64[\"']?[\\s\\x0b&\\),<>\\|]|n(?:ame[\"']?[\\s\\x0b&\\),<>\\|]|c))|h[\"']?[\\s\\x0b&\\),<>\\|])|tch[\"']?[\\s\\x0b&\\),<>\\|])|lkid[\"']?[\\s\\x0b&\\),<>\\|]|pftrace|r(?:eaksw|(?:idge|wap)[\"']?[\\s\\x0b&\\),<>\\|])|sd(?:cat|iff|tar)|u(?:iltin|n(?:dler[\"']?[\\s\\x0b&\\),<>\\|]|zip2)|s(?:ctl|ybox))|y(?:ebug|obu[\"']?[\\s\\x0b&\\),<>\\|]))|c(?:[89]9(?:[\"']?[\\s\\x0b&\\),<>\\|]|-gcc)|a(?:(?:t|ncel|psh)[\"']?[\\s\\x0b&\\),<>\\|]|rgo(?:-(?:audit|miri|watch)|[\"']?[\\s\\x0b&\\),<>\\|]))|(?:c|mp)[\"']?[\\s\\x0b&\\),<>\\|]|p(?:(?:an|io)?[\"']?[\\s\\x0b&\\),<>\\|]|ulimit)|s(?:(?:h|cli)[\"']?[\\s\\x0b&\\),<>\\|]|plit|vtool)|u(?:t[\"']?[\\s\\x0b&\\),<>\\|]|psfilter)|ertbot|h(?:(?:(?:att|di)r|mod|o(?:om|wn)|root|sh)[\"']?[\\s\\x0b&\\),<>\\|]|e(?:ck_(?:by_ssh|cups|log|memory|raid|s(?:sl_cert|tatusfile))|f(?:-|[\"']?[\\s\\x0b&\\),<>\\|]Line truncated
|
||||
"pattern": "(?i)(?:^(?:json\\.|\\x5c)?|b[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?u[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?s[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?y[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?b[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?o[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?x|(?:c[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?o[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?m[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?m[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?a[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?n[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?d|e[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?(?:n[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?v|v[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?a[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?l)|w[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?a[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?t[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?c[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?h)[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?[\"']?[\\s\\x0b&\\),<>\\|].*|[ls][\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?t[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?r[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?a[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?c[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?e|n[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?o[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?h[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?u[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?p|t[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?i[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?m[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?e[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?(?:[\"']?[\\s\\x0b&\\),<>\\|].*|o[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?u[\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?t)|[\\n\\r;=`\\{]|\\|\\|?|&&?|\\$(?:\\(\\(?|[\\[\\{])|<(?:\\(|<<)|>\\(|\\([\\s\\x0b]*\\))[\\s\\x0b]*(?:[!\\$\\(\\{][\\s\\x0b]*|(?:[0-9A-Z_a-z]+=[^\\s\\x0b]+|\\$[0-9A-Z_a-z]+)[\\s\\x0b]+)*[\\s\\x0b]*[\"']*(?:[\"'-\\+\\--9\\?A-\\]_a-z\\|]+/)?[\"'\\x5c]*(?:(?:7z[arx]?|(?:GE|POS)T|y(?:e(?:s|lp)|um|arn)|HEAD)[\"']?[\\s\\x0b&\\),<>\\|]|a(?:a-[^\\s\\x0b]{1,10}\\b|(?:b|w[ks]|l(?:ias|pine)|tobm|xel)[\"']?[\\s\\x0b&\\),<>\\|]|p(?:t(?:[\"']?[\\s\\x0b&\\),<>\\|]|-get)|parmor_[^\\s\\x0b]{1,10}\\b)|r(?:(?:p|ch)?[\"']?[\\s\\x0b&\\),<>\\|]|j(?:[\"']?[\\s\\x0b&\\),<>\\|]|-register|disp)|ia2c)|s(?:h[\"']?[\\s\\x0b&\\),<>\\|]|cii(?:-xfr|85)|pell)|dd(?:group|user)|getty|nsible|u(?:dit(?:2(?:allow|why)|ctl)|repor?t|search)|vcstat)|b(?:z(?:(?:z|c(?:at|mp))[\"']?[\\s\\x0b&\\),<>\\|]|diff|e(?:grep|xe[\"']?[\\s\\x0b&\\),<>\\|])|f?grep|ip2(?:[\"']?[\\s\\x0b&\\),<>\\|]|recover)|less|more)|a(?:s(?:e(?:32|64[\"']?[\\s\\x0b&\\),<>\\|]|n(?:ame[\"']?[\\s\\x0b&\\),<>\\|]|c))|h[\"']?[\\s\\x0b&\\),<>\\|])|tch[\"']?[\\s\\x0b&\\),<>\\|])|lkid[\"']?[\\s\\x0b&\\),<>\\|]|pftrace|r(?:eaksw|(?:idge|wap)[\"']?[\\s\\x0b&\\),<>\\|])|sd(?:cat|iff|tar)|u(?:iltin|n(?:dler[\"']?[\\s\\x0b&\\),<>\\|]|zip2)|s(?:ctl|ybox))|y(?:ebug|obu[\"']?[\\s\\x0b&\\),<>\\|]))|c(?:[89]9(?:[\"']?[\\s\\x0b&\\),<>\\|]|-gcc)|a(?:(?:t|ncel|psh)[\"']?[\\s\\x0b&\\),<>\\|]|rgo(?:-(?:audit|miri|watch)|[\"']?[\\s\\x0b&\\),<>\\|]))|(?:c|mp)[\"']?[\\s\\x0b&\\),<>\\|]|p(?:(?:an|io)?[\"']?[\\s\\x0b&\\),<>\\|]|ulimit)|s(?:(?:h|cli)[\"']?[\\s\\x0b&\\),<>\\|]|plit|vtool)|u(?:t[\"']?[\\s\\x0b&\\),<>\\|]|psfilter)|ertbot|h(?:(?:(?:att|di)r|c(?:at|on)|mod|o(?:om|wn)|root|sh)[\"']?[\\s\\x0b&\\),<>\\|]|e(?:ck(?:_(?:by_ssh|cups|log|memory|raid|s(?:sl_cert|taLine truncated
|
||||
"targets": [
|
||||
"uri",
|
||||
"user_agent"
|
||||
],
|
||||
"action": "score",
|
||||
@@ -1367,8 +1389,9 @@
|
||||
{
|
||||
"id": "932237",
|
||||
"name": "Remote Command Execution: Unix Shell Code Found in REQUEST_HEADERS",
|
||||
"pattern": "(?i)\\b(?:(?:7z[arx]?|(?:GE|POS)T|y(?:e(?:s|lp)|um|arn)|HEAD)[\"']?[\\s\\x0b&\\),<>\\|]|a(?:a-[^\\s\\x0b]{1,10}\\b|(?:b|t(?:obm)?|w[ks]|l(?:ias|pine)|xel)[\"']?[\\s\\x0b&\\),<>\\|]|p(?:t(?:(?:itude)?[\"']?[\\s\\x0b&\\),<>\\|]|-get)|parmor_[^\\s\\x0b]{1,10}\\b)|r(?:(?:p|ch)?[\"']?[\\s\\x0b&\\),<>\\|]|j(?:[\"']?[\\s\\x0b&\\),<>\\|]|-register|disp)|ia2c)|s(?:h?[\"']?[\\s\\x0b&\\),<>\\|]|cii(?:-xfr|85)|pell)|dd(?:group|user)|getty|nsible|u(?:ditctl|repot|search))|b(?:z(?:(?:z|c(?:at|mp))[\"']?[\\s\\x0b&\\),<>\\|]|diff|e(?:grep|xe[\"']?[\\s\\x0b&\\),<>\\|])|f?grep|ip2(?:[\"']?[\\s\\x0b&\\),<>\\|]|recover)|less|more)|a(?:s(?:e(?:32|64[\"']?[\\s\\x0b&\\),<>\\|]|n(?:ame[\"']?[\\s\\x0b&\\),<>\\|]|c))|h[\"']?[\\s\\x0b&\\),<>\\|])|tch[\"']?[\\s\\x0b&\\),<>\\|])|lkid[\"']?[\\s\\x0b&\\),<>\\|]|pftrace|r(?:eaksw|(?:idge|wap)[\"']?[\\s\\x0b&\\),<>\\|])|sd(?:cat|iff|tar)|u(?:iltin|n(?:dler[\"']?[\\s\\x0b&\\),<>\\|]|zip2)|s(?:ctl|ybox))|y(?:ebug|obu[\"']?[\\s\\x0b&\\),<>\\|]))|c(?:[89]9(?:[\"']?[\\s\\x0b&\\),<>\\|]|-gcc)|a(?:(?:t|ncel|psh)[\"']?[\\s\\x0b&\\),<>\\|]|rgo(?:-(?:audit|miri|watch)|[\"']?[\\s\\x0b&\\),<>\\|]))|(?:c|mp)[\"']?[\\s\\x0b&\\),<>\\|]|p(?:(?:an|io)?[\"']?[\\s\\x0b&\\),<>\\|]|ulimit)|s(?:(?:h|cli)[\"']?[\\s\\x0b&\\),<>\\|]|plit|vtool)|u(?:t[\"']?[\\s\\x0b&\\),<>\\|]|psfilter)|ertbot|h(?:(?:(?:att|di)r|mod|o(?:om|wn)|root|sh)[\"']?[\\s\\x0b&\\),<>\\|]|e(?:ck_(?:by_ssh|cups|log|memory|raid|s(?:sl_cert|tatusfile))|f(?:-|[\"']?[\\s\\x0b&\\),<>\\|]))|(?:flag|pas)s|g(?:passwd|rp[\"']?[\\s\\x0b&\\),<>\\|]))|l(?:ang(?:\\+\\+|[\"']?[\\s\\x0b&\\),<>\\|])|ippy-driver)|o(?:bc(?:[\"']?[\\s\\x0b&\\),<>\\|]|run)|(?:lumn|m(?:m(?:and)?|p(?:oser|ress)))[\"']?[\\s\\x0b&\\),<>\\|]|proc|w(?:say|think))|r(?:ash[\"']?[\\s\\x0b&\\),<>\\|]|on(?:[\"']?[\\s\\x0b&\\),<>\\|]|tab)))|d(?:(?:[dfu]|i(?:(?:alo)?g|r|ff)|a(?:sh|te)|vips)[\"']?[\\s\\x0b&\\),<>\\|]|nf(?:[\"']?[\\s\\x0b&\\),<>\\|])?|hclient|m(?:esg[\"']?[\\s\\x0b&\\),<>\\|]|idecode|setup)|o(?:(?:as|ne)[\"']?[\\s\\x0b&\\),<>\\|]|cker(?:-|[\"']?[\\s\\x0b&\\),<>\\|])|sbox)|pkg(?:-|[\"']?[\\s\\x0b&\\),<>\\|]))|e(?:(?:[bd]|qn|s(?:h|ac)?|cho|fax|grep|macs|val)[\"']?[\\s\\x0b&\\),<>\\|]|n(?:v(?:[\"']?[\\s\\x0b&\\),<>\\|]|-update)|d(?:if|sw)[\"']?[\\s\\x0b&\\),<>\\|])|x(?:(?:ec|p(?:and|(?:ec|or)t|r))?[\"']?[\\s\\x0b&\\),<>\\|]|iftool)|2fsck|asy_install)|f(?:(?:c|g(?:rep)?|mt|etch|lock|unction)[\"']?[\\s\\x0b&\\),<>\\|]|i(?:(?:n(?:d|ger)|sh)?[\"']?[\\s\\x0b&\\),<>\\|]|le(?:[\"']?[\\s\\x0b&\\),<>\\|]|test))|tp(?:[\"']?[\\s\\x0b&\\),<>\\|]|stats|who)|acter|d(?:(?:find|isk)[\"']?[\\s\\x0b&\\),<>\\|]|u?mount)|o(?:ld[\"']?[\\s\\x0b&\\),<>\\|]|reach)|ping(?:6|[\"']?[\\s\\x0b&\\),<>\\|]))|g(?:c(?:c[^\\s\\x0b]{1,10}\\b|ore[\"']?[\\s\\x0b&\\),<>\\|])|(?:db|i(?:t|mp|nsh)|o|pg|awk|z(?:cat|exe|ip))[\"']?[\\s\\x0b&\\),<>\\|]|e(?:m[\"']?[\\s\\x0b&\\),<>\\|]|ni(?:e[\"']?[\\s\\x0b&\\),<>\\|]|soimage)|t(?:cap|facl[\"']?[\\s\\x0b&\\),<>\\|]))|hc(?:-?[\"']?[\\s\\x0b&\\),<>\\|]|i(?:-|[\"']?[\\s\\x0b&\\),<>\\|]))|r(?:(?:c(?:at)?|ep)[\"']?[\\s\\x0b&\\),<>\\|]|oupmod)|tester|unzip)|h(?:(?:d|up|ash|i(?:ghlight|story))[\"']?[\\s\\x0b&\\),<>\\|]|e(?:ad[\"']?[\\s\\x0b&\\),<>\\|]|xdump)|ost(?:id|name)|ping3|t(?:digest|op[\"']?[\\s\\x0b&\\),<>\\|]|passwd))|i(?:(?:d|rb|conv|nstall)[\"']?[\\s\\x0b&\\),<>\\|]|p(?:[\"']?[\\s\\x0b&\\),<>\\|]|6?tables|config|p(?:eveprinter|find|tool))|f(?:config|top[\"']?[\\s\\x0b&\\),<>\\|])|onice|spell)|j(?:(?:js|q|ava|exec)[\"']?[\\s\\x0b&\\),<>\\|]|o(?:(?:bs|in)[\"']?[\\s\\x0b&\\),<>\\|]|urnalctl)|runscript)|k(?:s(?:h[\"']?[\\s\\x0b&\\),<>\\|]|shell)|ill(?:[\"']?[\\s\\x0b&\\),<>\\|]|all)|nife[\"']?[\\s\\x0b&\\),<>\\|])|l(?:(?:a(?:st(?:comm|log(?:in)?)?|tex)?|[lnp]|ynx)?[\"']?[\\s\\x0b&\\),<>\\|]|d(?:d?[\"']?[\\s\\x0b&\\),<>\\|]|config)|s(?:(?:-F|cpu|hw|mod|of|pci|usb)?[\"']?[\\s\\x0b&\\),<>\\|]|b_release)|ua(?:[\"']?[\\s\\x0b&\\),<>\\|]|(?:la)?tex)|z(?:4(?:[\"']?[\\s\\x0b&\\),<>\\|]|c(?:[\"']?[\\s\\x0b&\\),<>\\|]|at))|(?:c(?:at|mp))?[\"']?[\\s\\x0b&\\),<>\\|]|diff|[ef]?grep|less|m(?:a(?:[\"']?[\\s\\x0b&\\),<>\\|]|dec|info)|ore))|ess(?:[\"']?[\\s\\x0b&\\),<>\\|]|echo|(?:fil|pip)e)|ftp(?:[\"']?[\\s\\x0b&\\),<>\\|]|get)|o(?:(?:ca(?:l|te)|ok)[\"']?[\\s\\x0b&\\),<>\\|]|g(?:inctl|(?:nam|sav)e)|setup)|trace|wp-(?:d(?:ownload|ump)|mirror|request))|m(?:(?:a(?:n|il[qx]?|ke|wk)|tr|v|utt)[\"']?[\\s\\x0b&\\),<>\\|]|k(?:(?:dir|nod)[\"']?[\\s\\x0b&\\),<>\\|]|fifo|temp)|locate|o(?:(?:re|unt)[\"']?[\\s\\x0b&\\),<>\\|]|squitto)|sg(?:attrib|c(?:at|onv)|filter|merge|uniq)|ysql(?:[\"']?[\\s\\x0b&\\),<>\\|]|admin|dump(?:slow)?|hotcopy|show))|n(?:c(?:(?:at)?[\"']?[\\s\\x0b&\\),<>\\|]|\\.(?:openbsd|traditional))|e(?:t(?:[\"']?[\\s\\x0b&\\),<>\\|]|(?:c|st)at|kit-ftp|plan)|ofetch)|(?:l|m(?:ap)?|p(?:m|ing)|a(?:no|sm|wk)|ice|o(?:de|hup)|roff)[\"']?[\\s\\x0b&\\),<>\\|]|s(?:enter|lookup|tat[\"']?[\\s\\x0b&\\),<>\\|]))|o(?:(?:d|ctave)[\"']?[\\s\\x0b&\\),<>\\|]|nintr|p(?:en(?:ssl|v(?:pn|t))|kg[\"']?[\\s\\x0b&\\),<>\\|]))|p(?:a(?:(?:x|cman|rted|tch)[\"']?[\\s\\x0b&\\),<>\\|]|s(?:swd|te[\"']?Line truncated
|
||||
"pattern": "(?i)\\b(?:(?:7z[arx]?|(?:GE|POS)T|y(?:e(?:s|lp)|um|arn)|HEAD)[\"']?[\\s\\x0b&\\),<>\\|]|a(?:a-[^\\s\\x0b]{1,10}\\b|(?:b|t(?:obm)?|w[ks]|l(?:ias|pine)|xel)[\"']?[\\s\\x0b&\\),<>\\|]|p(?:t(?:(?:itude)?[\"']?[\\s\\x0b&\\),<>\\|]|-get)|parmor_[^\\s\\x0b]{1,10}\\b)|r(?:(?:p|ch)?[\"']?[\\s\\x0b&\\),<>\\|]|j(?:[\"']?[\\s\\x0b&\\),<>\\|]|-register|disp)|ia2c)|s(?:h?[\"']?[\\s\\x0b&\\),<>\\|]|cii(?:-xfr|85)|pell)|dd(?:group|user)|getty|nsible|u(?:dit(?:2(?:allow|why)|ctl)|repor?t|search)|vcstat)|b(?:z(?:(?:z|c(?:at|mp))[\"']?[\\s\\x0b&\\),<>\\|]|diff|e(?:grep|xe[\"']?[\\s\\x0b&\\),<>\\|])|f?grep|ip2(?:[\"']?[\\s\\x0b&\\),<>\\|]|recover)|less|more)|a(?:s(?:e(?:32|64[\"']?[\\s\\x0b&\\),<>\\|]|n(?:ame[\"']?[\\s\\x0b&\\),<>\\|]|c))|h[\"']?[\\s\\x0b&\\),<>\\|])|tch[\"']?[\\s\\x0b&\\),<>\\|])|lkid[\"']?[\\s\\x0b&\\),<>\\|]|pftrace|r(?:eaksw|(?:idge|wap)[\"']?[\\s\\x0b&\\),<>\\|])|sd(?:cat|iff|tar)|u(?:iltin|n(?:dler[\"']?[\\s\\x0b&\\),<>\\|]|zip2)|s(?:ctl|ybox))|y(?:ebug|obu[\"']?[\\s\\x0b&\\),<>\\|]))|c(?:[89]9(?:[\"']?[\\s\\x0b&\\),<>\\|]|-gcc)|a(?:(?:t|ncel|psh)[\"']?[\\s\\x0b&\\),<>\\|]|rgo(?:-(?:audit|miri|watch)|[\"']?[\\s\\x0b&\\),<>\\|]))|(?:c|mp)[\"']?[\\s\\x0b&\\),<>\\|]|p(?:(?:an|io)?[\"']?[\\s\\x0b&\\),<>\\|]|ulimit)|s(?:(?:h|cli)[\"']?[\\s\\x0b&\\),<>\\|]|plit|vtool)|u(?:t[\"']?[\\s\\x0b&\\),<>\\|]|psfilter)|ertbot|h(?:(?:(?:att|di)r|c(?:at|on)|mod|o(?:om|wn)|root|sh)[\"']?[\\s\\x0b&\\),<>\\|]|e(?:ck(?:_(?:by_ssh|cups|log|memory|raid|s(?:sl_cert|tatusfile))|module|policy)|f(?:-|[\"']?[\\s\\x0b&\\),<>\\|]))|(?:flag|pas)s|g(?:passwd|rp[\"']?[\\s\\x0b&\\),<>\\|]))|l(?:ang(?:\\+\\+|[\"']?[\\s\\x0b&\\),<>\\|])|ippy-driver)|o(?:bc(?:[\"']?[\\s\\x0b&\\),<>\\|]|run)|(?:lumn|m(?:m(?:and)?|p(?:oser|ress)))[\"']?[\\s\\x0b&\\),<>\\|]|proc|w(?:say|think))|r(?:ash[\"']?[\\s\\x0b&\\),<>\\|]|on(?:[\"']?[\\s\\x0b&\\),<>\\|]|tab)))|d(?:(?:[dfu]|i(?:(?:alo)?g|r|ff)|a(?:sh|te)|vips)[\"']?[\\s\\x0b&\\),<>\\|]|nf(?:[\"']?[\\s\\x0b&\\),<>\\|])?|hclient|m(?:esg[\"']?[\\s\\x0b&\\),<>\\|]|idecode|setup)|o(?:(?:as|ne)[\"']?[\\s\\x0b&\\),<>\\|]|cker(?:-|[\"']?[\\s\\x0b&\\),<>\\|])|sbox)|pkg(?:-|[\"']?[\\s\\x0b&\\),<>\\|]))|e(?:(?:[bd]|qn|s(?:h|ac)?|cho|fax|grep|macs|val)[\"']?[\\s\\x0b&\\),<>\\|]|n(?:v(?:[\"']?[\\s\\x0b&\\),<>\\|]|-update)|d(?:if|sw)[\"']?[\\s\\x0b&\\),<>\\|])|x(?:(?:ec|p(?:and|(?:ec|or)t|r))?[\"']?[\\s\\x0b&\\),<>\\|]|iftool)|2fsck|asy_install)|f(?:(?:c|g(?:rep)?|mt|etch|lock|unction)[\"']?[\\s\\x0b&\\),<>\\|]|i(?:(?:sh|xfiles)?[\"']?[\\s\\x0b&\\),<>\\|]|le(?:[\"']?[\\s\\x0b&\\),<>\\|]|test)|n(?:d(?:[\"']?[\\s\\x0b&\\),<>\\|]|con)|ger[\"']?[\\s\\x0b&\\),<>\\|]))|tp(?:[\"']?[\\s\\x0b&\\),<>\\|]|stats|who)|acter|d(?:(?:find|isk)[\"']?[\\s\\x0b&\\),<>\\|]|u?mount)|o(?:ld[\"']?[\\s\\x0b&\\),<>\\|]|reach)|ping(?:6|[\"']?[\\s\\x0b&\\),<>\\|]))|g(?:c(?:c[^\\s\\x0b]{1,10}\\b|ore[\"']?[\\s\\x0b&\\),<>\\|])|(?:db|i(?:t|mp|nsh)|o|pg|awk|z(?:cat|exe|ip))[\"']?[\\s\\x0b&\\),<>\\|]|e(?:m[\"']?[\\s\\x0b&\\),<>\\|]|n(?:homedircon|i(?:e[\"']?[\\s\\x0b&\\),<>\\|]|soimage))|t(?:cap|enforce|facl[\"']?[\\s\\x0b&\\),<>\\|]|sebool))|hc(?:-?[\"']?[\\s\\x0b&\\),<>\\|]|i(?:-|[\"']?[\\s\\x0b&\\),<>\\|]))|r(?:(?:c(?:at)?|ep|ubby)[\"']?[\\s\\x0b&\\),<>\\|]|oupmod)|tester|unzip)|h(?:(?:d|up|ash|i(?:ghlight|story))[\"']?[\\s\\x0b&\\),<>\\|]|e(?:ad[\"']?[\\s\\x0b&\\),<>\\|]|xdump)|ost(?:id|name)|ping3|t(?:digest|op[\"']?[\\s\\x0b&\\),<>\\|]|passwd))|i(?:(?:d|rb|conv)[\"']?[\\s\\x0b&\\),<>\\|]|p(?:[\"']?[\\s\\x0b&\\),<>\\|]|6?tables|config|p(?:eveprinter|find|tool))|f(?:config|top[\"']?[\\s\\x0b&\\),<>\\|])|n(?:dexcon|stall[\"']?[\\s\\x0b&\\),<>\\|])|onice|spell)|j(?:(?:js|q|ava|exec)[\"']?[\\s\\x0b&\\),<>\\|]|o(?:(?:bs|in)[\"']?[\\s\\x0b&\\),<>\\|]|urnalctl)|runscript)|k(?:s(?:h[\"']?[\\s\\x0b&\\),<>\\|]|shell)|ill(?:[\"']?[\\s\\x0b&\\),<>\\|]|all)|nife[\"']?[\\s\\x0b&\\),<>\\|])|l(?:(?:a(?:st(?:comm|log(?:in)?)?|tex)?|[lnp]|ynx)?[\"']?[\\s\\x0b&\\),<>\\|]|d(?:d?[\"']?[\\s\\x0b&\\),<>\\|]|config)|s(?:(?:-F|cpu|hw|mod|of|pci|usb)?[\"']?[\\s\\x0b&\\),<>\\|]|b_release)|ua(?:[\"']?[\\s\\x0b&\\),<>\\|]|(?:la)?tex)|z(?:4(?:[\"']?[\\s\\x0b&\\),<>\\|]|c(?:[\"']?[\\s\\x0b&\\),<>\\|]|at))|(?:c(?:at|mp))?[\"']?[\\s\\x0b&\\),<>\\|]|diff|[ef]?grep|less|m(?:a(?:[\"']?[\\s\\x0b&\\),<>\\|]|dec|info)|ore))|ess(?:[\"']?[\\s\\x0b&\\),<>\\|]|echo|(?:fil|pip)e)|ftp(?:[\"']?[\\s\\x0b&\\),<>\\|]|get)|o(?:(?:ad_policy|ca(?:l|te)|ok)[\"']?[\\s\\x0b&\\),<>\\|]|g(?:inctl|(?:nam|sav)e)|setup)|trace|wp-(?:d(?:ownload|ump)|mirror|request))|m(?:a(?:(?:n|il[qx]?|ke|wk)[\"']?[\\s\\x0b&\\),<>\\|]|tchpathcon)|(?:tr|v|utt)[\"']?[\\s\\x0b&\\),<>\\|]|k(?:(?:dir|nod)[\"']?[\\s\\x0b&\\),<>\\|]|fifo|temp)|locate|o(?:(?:re|unt)[\"']?[\\s\\x0b&\\),<>\\|]|squitto)|sg(?:attrib|c(?:at|onv)|filter|merge|uniq)|ysql(?:[\"']?[\\s\\x0b&\\),<>\\|]|admin|dump(?:slow)?|hotcopy|show))|n(?:c(?:(?:at)?[\"']?[\\s\\x0b&\\),<>\\|]|\\.(?:openbsd|traditional))|e(?:t(?:[\"']?[\\s\\x0b&\\),<>\\|]|(?:c|st)at|kit-ftp|plan)|ofetch|wrole[\"']?[\\s\\x0b&\\),<>\\|])|(?:l|m(?:ap)?|p(?:m|ing)|a(?:nLine truncated
|
||||
"targets": [
|
||||
"uri",
|
||||
"user_agent"
|
||||
],
|
||||
"action": "score",
|
||||
@@ -1558,9 +1581,9 @@
|
||||
{
|
||||
"id": "crs-php",
|
||||
"name": "CRS PHP Injection",
|
||||
"version": "4.29.0",
|
||||
"version": "4.30.0",
|
||||
"source": "owasp-crs",
|
||||
"description": "OWASP CRS v4.29.0 — CRS PHP Injection (18 rules)",
|
||||
"description": "OWASP CRS v4.30.0 — CRS PHP Injection (18 rules)",
|
||||
"author": "OWASP CRS Project",
|
||||
"priority": 5,
|
||||
"enabled": true,
|
||||
@@ -1589,7 +1612,7 @@
|
||||
{
|
||||
"id": "933110",
|
||||
"name": "PHP Injection Attack: PHP Script File Upload Found",
|
||||
"pattern": ".*\\.ph(?:p\\d*|tml|ar|ps|t|pt)\\.*$",
|
||||
"pattern": ".*\\.ph(?:p\\d*|tml|ar|ps|t|pt)[./]*$",
|
||||
"targets": [
|
||||
"filename"
|
||||
],
|
||||
@@ -1948,9 +1971,9 @@
|
||||
{
|
||||
"id": "crs-generic-attack",
|
||||
"name": "CRS Generic Application Attack",
|
||||
"version": "4.29.0",
|
||||
"version": "4.30.0",
|
||||
"source": "owasp-crs",
|
||||
"description": "OWASP CRS v4.29.0 — CRS Generic Application Attack (12 rules)",
|
||||
"description": "OWASP CRS v4.30.0 — CRS Generic Application Attack (12 rules)",
|
||||
"author": "OWASP CRS Project",
|
||||
"priority": 5,
|
||||
"enabled": true,
|
||||
@@ -2067,7 +2090,7 @@
|
||||
{
|
||||
"id": "934200",
|
||||
"name": "Server-Side Template Injection (SSTI) Attack",
|
||||
"pattern": "(?:\\{\\{[^\\}]*?(?:[\\(\\*]|__)[^\\}]*?\\}|#\\{[^\\}]*?(?:[\\(\\*]|__)[^\\}]*?)\\}|<%=?[\\s\\x0b]*[^%]*?(?:[\\(\\*]|__)[^%]*?%>",
|
||||
"pattern": "\\{\\{[^\\}]*?(?:[\\(\\*]|__)[^\\}]*?\\}\\}|#(?:\\{[^\\}]*?(?:[\\(\\*]|__)[^\\}]*?\\}|[0-9A-Z_a-z]+[\\s\\x0b]*\\([\\s\\x0b]*\\$[^\\)]*?(?:[\\(\\*]|__)[^\\)]*?\\))|<(?:%=?[\\s\\x0b]*[^%]*?(?:[\\(\\*]|__)[^%]*?%|[#@][0-9A-Z_a-z]+[^>]*?(?:[\\(\\*]|__)[^>]*?)>",
|
||||
"targets": [
|
||||
"all"
|
||||
],
|
||||
@@ -2222,9 +2245,9 @@
|
||||
{
|
||||
"id": "crs-xss",
|
||||
"name": "CRS Cross-Site Scripting (XSS)",
|
||||
"version": "4.29.0",
|
||||
"version": "4.30.0",
|
||||
"source": "owasp-crs",
|
||||
"description": "OWASP CRS v4.29.0 — CRS Cross-Site Scripting (XSS) (30 rules)",
|
||||
"description": "OWASP CRS v4.30.0 — CRS Cross-Site Scripting (XSS) (30 rules)",
|
||||
"author": "OWASP CRS Project",
|
||||
"priority": 5,
|
||||
"enabled": true,
|
||||
@@ -2864,9 +2887,9 @@
|
||||
{
|
||||
"id": "crs-sqli",
|
||||
"name": "CRS SQL Injection (SQLi)",
|
||||
"version": "4.29.0",
|
||||
"version": "4.30.0",
|
||||
"source": "owasp-crs",
|
||||
"description": "OWASP CRS v4.29.0 — CRS SQL Injection (SQLi) (55 rules)",
|
||||
"description": "OWASP CRS v4.30.0 — CRS SQL Injection (SQLi) (55 rules)",
|
||||
"author": "OWASP CRS Project",
|
||||
"priority": 3,
|
||||
"enabled": true,
|
||||
@@ -4035,9 +4058,9 @@
|
||||
{
|
||||
"id": "crs-session-fixation",
|
||||
"name": "CRS Session Fixation",
|
||||
"version": "4.29.0",
|
||||
"version": "4.30.0",
|
||||
"source": "owasp-crs",
|
||||
"description": "OWASP CRS v4.29.0 — CRS Session Fixation (1 rules)",
|
||||
"description": "OWASP CRS v4.30.0 — CRS Session Fixation (1 rules)",
|
||||
"author": "OWASP CRS Project",
|
||||
"priority": 10,
|
||||
"enabled": true,
|
||||
@@ -4068,9 +4091,9 @@
|
||||
{
|
||||
"id": "crs-java-attack",
|
||||
"name": "CRS Java / Deserialization Attack",
|
||||
"version": "4.29.0",
|
||||
"version": "4.30.0",
|
||||
"source": "owasp-crs",
|
||||
"description": "OWASP CRS v4.29.0 — CRS Java / Deserialization Attack (11 rules)",
|
||||
"description": "OWASP CRS v4.30.0 — CRS Java / Deserialization Attack (11 rules)",
|
||||
"author": "OWASP CRS Project",
|
||||
"priority": 3,
|
||||
"enabled": true,
|
||||
@@ -4099,7 +4122,7 @@
|
||||
{
|
||||
"id": "944140",
|
||||
"name": "Java Injection Attack: Java Script File Upload Found",
|
||||
"pattern": ".*\\.(?:jsp|jspx)\\.*$",
|
||||
"pattern": ".*\\.(?:jsp|jspx)[./]*$",
|
||||
"targets": [
|
||||
"filename"
|
||||
],
|
||||
@@ -4311,9 +4334,9 @@
|
||||
{
|
||||
"id": "crs-data-leakage",
|
||||
"name": "CRS Data Leakage Detection",
|
||||
"version": "4.29.0",
|
||||
"version": "4.30.0",
|
||||
"source": "owasp-crs",
|
||||
"description": "OWASP CRS v4.29.0 — CRS Data Leakage Detection (3 rules)",
|
||||
"description": "OWASP CRS v4.30.0 — CRS Data Leakage Detection (3 rules)",
|
||||
"author": "OWASP CRS Project",
|
||||
"priority": 15,
|
||||
"enabled": true,
|
||||
@@ -4386,9 +4409,9 @@
|
||||
{
|
||||
"id": "crs-data-leakage-sql",
|
||||
"name": "CRS SQL Data Leakage",
|
||||
"version": "4.29.0",
|
||||
"version": "4.30.0",
|
||||
"source": "owasp-crs",
|
||||
"description": "OWASP CRS v4.29.0 — CRS SQL Data Leakage (16 rules)",
|
||||
"description": "OWASP CRS v4.30.0 — CRS SQL Data Leakage (16 rules)",
|
||||
"author": "OWASP CRS Project",
|
||||
"priority": 15,
|
||||
"enabled": true,
|
||||
@@ -4648,7 +4671,7 @@
|
||||
{
|
||||
"id": "951230",
|
||||
"name": "mysql SQL Information Leakage",
|
||||
"pattern": "(?i)(?:supplied argument is not a valid |SQL syntax.*)MySQL|Column count doesn't match(?: value count at row)?|mysql_fetch_array\\(\\)|on MySQL result index|You have an error in your SQL syntax(?:;| near)|MyS(?:QL server version for the right syntax to use|qlClient\\.)|\\[MySQL\\]\\[ODBC|(?:Table '[^']+' doesn't exis|valid MySQL resul)t|Warning.{1,10}mysql_(?:[\\(\\)_a-z]{1,26})?|(?:ERROR [0-9]{4} \\([0-9a-z]{5}\\)|XPATH syntax error):",
|
||||
"pattern": "(?i)supplied argument is not a valid MySQL|Column count doesn't match(?: value count at row)?|mysql_fetch_array\\(\\)|on MySQL result index|You have an error in your SQL syntax(?:;| near)|MyS(?:QL server version for the right syntax to use|qlClient\\.)|\\[MySQL\\]\\[ODBC|(?:Table '[^']+' doesn't exis|valid MySQL resul)t|Warning.{1,10}mysql_(?:[\\(\\)_a-z]{1,26})?|(?:ERROR [0-9]{4} \\([0-9a-z]{5}\\)|XPATH syntax error):",
|
||||
"targets": [
|
||||
"body"
|
||||
],
|
||||
@@ -4734,9 +4757,9 @@
|
||||
{
|
||||
"id": "crs-data-leakage-java",
|
||||
"name": "CRS Java Data Leakage",
|
||||
"version": "4.29.0",
|
||||
"version": "4.30.0",
|
||||
"source": "owasp-crs",
|
||||
"description": "OWASP CRS v4.29.0 — CRS Java Data Leakage (1 rules)",
|
||||
"description": "OWASP CRS v4.30.0 — CRS Java Data Leakage (1 rules)",
|
||||
"author": "OWASP CRS Project",
|
||||
"priority": 15,
|
||||
"enabled": true,
|
||||
@@ -4767,9 +4790,9 @@
|
||||
{
|
||||
"id": "crs-data-leakage-php",
|
||||
"name": "CRS PHP Data Leakage",
|
||||
"version": "4.29.0",
|
||||
"version": "4.30.0",
|
||||
"source": "owasp-crs",
|
||||
"description": "OWASP CRS v4.29.0 — CRS PHP Data Leakage (3 rules)",
|
||||
"description": "OWASP CRS v4.30.0 — CRS PHP Data Leakage (3 rules)",
|
||||
"author": "OWASP CRS Project",
|
||||
"priority": 15,
|
||||
"enabled": true,
|
||||
@@ -4842,9 +4865,9 @@
|
||||
{
|
||||
"id": "crs-data-leakage-iis",
|
||||
"name": "CRS IIS Data Leakage",
|
||||
"version": "4.29.0",
|
||||
"version": "4.30.0",
|
||||
"source": "owasp-crs",
|
||||
"description": "OWASP CRS v4.29.0 — CRS IIS Data Leakage (3 rules)",
|
||||
"description": "OWASP CRS v4.30.0 — CRS IIS Data Leakage (3 rules)",
|
||||
"author": "OWASP CRS Project",
|
||||
"priority": 15,
|
||||
"enabled": true,
|
||||
@@ -4917,9 +4940,9 @@
|
||||
{
|
||||
"id": "crs-web-shells",
|
||||
"name": "CRS Web Shell Detection",
|
||||
"version": "4.29.0",
|
||||
"version": "4.30.0",
|
||||
"source": "owasp-crs",
|
||||
"description": "OWASP CRS v4.29.0 — CRS Web Shell Detection (23 rules)",
|
||||
"description": "OWASP CRS v4.30.0 — CRS Web Shell Detection (23 rules)",
|
||||
"author": "OWASP CRS Project",
|
||||
"priority": 3,
|
||||
"enabled": true,
|
||||
@@ -5412,9 +5435,9 @@
|
||||
{
|
||||
"id": "crs-data-leakage-ruby",
|
||||
"name": "CRS Ruby Data Leakage",
|
||||
"version": "4.29.0",
|
||||
"version": "4.30.0",
|
||||
"source": "owasp-crs",
|
||||
"description": "OWASP CRS v4.29.0 — CRS Ruby Data Leakage (1 rules)",
|
||||
"description": "OWASP CRS v4.30.0 — CRS Ruby Data Leakage (1 rules)",
|
||||
"author": "OWASP CRS Project",
|
||||
"priority": 15,
|
||||
"enabled": true,
|
||||
|
||||
Reference in new issue
Block a user