mirror of
https://github.com/owasp-modsecurity/ModSecurity.git
synced 2025-08-13 21:36:00 +03:00
35 lines
2.4 KiB
Plaintext
35 lines
2.4 KiB
Plaintext
# ---------------------------------------------------------------
|
|
# Core ModSecurity Rule Set ver.1.6.1
|
|
# Copyright (C) 2006-2007 Breach Security Inc. All rights reserved.
|
|
#
|
|
# The ModSecuirty Core Rule Set is distributed under GPL version 2
|
|
# Please see the enclosed LICENCE file for full details.
|
|
# ---------------------------------------------------------------
|
|
|
|
|
|
# The trojan access detection rules detects access to known Trojans already
|
|
# installed on a server. Uploading of Trojans is part of the Anti-Virus rules
|
|
# and uses external Anti Virus program when uploading files.
|
|
#
|
|
# Detection of Trojans access is especially important in a hosting environment
|
|
# where the actual Trojan upload may be done through valid methods and not
|
|
# through hacking.
|
|
# --
|
|
#
|
|
# NOTE Trojans detection is based on checking elements controlled by the client.
|
|
# A determined attacked can bypass those checks. We are working on
|
|
# enchaining the checks so it would require a major change in the Trojan
|
|
# to overcome.
|
|
#
|
|
# NOTE We found out that Trojan horses are not detected easily by Anti-Virus
|
|
# software when uploading as the signature set of AV software is not tuned
|
|
# for this purpose. We are working on adding signature tuned to detect
|
|
# Trojans upload to file uploading inspection.
|
|
#
|
|
|
|
SecRule REQUEST_HEADERS_NAMES "x_(?:key|file)\b" "phase:2,t:none,t:lowercase,ctl:auditLogParts=+E,deny,log,auditlog,status:404,msg:'Backdoor access',id:'950110',tag:'MALICIOUS_SOFTWARE/TROJAN',severity:'2'"
|
|
SecRule REQUEST_FILENAME "root\.exe" \
|
|
"phase:2,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,ctl:auditLogParts=+E,deny,log,auditlog,status:404,msg:'Backdoor access',id:'950921',tag:'MALICIOUS_SOFTWARE/TROJAN',severity:'2'"
|
|
SecRule RESPONSE_BODY "(?:<title>[^<]*?(?:\b(?:(?:c(?:ehennemden|gi-telnet)|gamma web shell)\b|imhabirligi phpftp)|(?:r(?:emote explorer|57shell)|aventis klasvayv|zehir)\b|\.::(?:news remote php shell injection::\.| rhtools\b)|ph(?:p(?:(?: commander|-terminal)\b|remoteview)|vayv)|myshell)|\b(?:(?:(?:microsoft windows\b.{,10}?\bversion\b.{,20}?\(c\) copyright 1985-.{,10}?\bmicrosoft corp|ntdaddy v1\.9 - obzerve \| fux0r inc)\.|(?:www\.sanalteror\.org - indexer and read|haxplor)er|php(?:konsole| shell)|c99shell)\b|aventgrup\.<br>|drwxr))" \
|
|
"phase:4,t:none,ctl:auditLogParts=+E,deny,log,auditlog,status:404,msg:'Backdoor access',id:'950922',tag:'MALICIOUS_SOFTWARE/TROJAN',severity:'2'"
|