rules.json

{
    "rules": [
        {
            "id": "SQL_INJECTION_1",
            "name": "SQL Injection Detection",
            "pattern": "(?i)(union\\s+select|select\\s+.*\\s+from|insert\\s+into|update\\s+.*\\s+set|delete\\s+from|drop\\s+table|create\\s+table)",
            "action": "block",
            "enabled": true,
            "description": "Detects common SQL injection patterns"
        },
        {
            "id": "SQL_COMMENT_INJECTION_1",
            "name": "SQL Comment Injection Detection",
            "pattern": "(?i)(/\\*.*\\*/|--\\s*$|#\\s*$|/\\*!\\d+.*\\*/)",
            "action": "block",
            "enabled": true,
            "description": "Detects SQL comment injection attempts (/* */, --, #)"
        },
        {
            "id": "SQL_TAUTOLOGY_1",
            "name": "SQL Tautology Detection",
            "pattern": "(?i)(\\s+or\\s+1\\s*=\\s*1|\\s+or\\s+'1'\\s*=\\s*'1'|\\s+or\\s+\"1\"\\s*=\\s*\"1\"|\\s+or\\s+true|\\s+or\\s+1\\s*=\\s*1\\s*--|\\s+or\\s+1\\s*=\\s*1\\s*#|\\s+or\\s+1\\s*=\\s*1\\s*/\\*)",
            "action": "block",
            "enabled": true,
            "description": "Detects SQL tautology injection attempts (OR 1=1, OR '1'='1', etc.)"
        },
        {
            "id": "SQL_TIME_BASED_1",
            "name": "SQL Time-Based Function Detection",
            "pattern": "(?i)(sleep\\s*\\(|benchmark\\s*\\(|pg_sleep\\s*\\(|waitfor\\s+delay|dbms_pipe\\.receive_message|heavyquery\\s*\\(|heavy_operation\\s*\\(|heavy_function\\s*\\()",
            "action": "block",
            "enabled": true,
            "description": "Detects SQL time-based function injection attempts (SLEEP, BENCHMARK, etc.)"
        },
        {
            "id": "SYSTEM_FILES_1",
            "name": "System Files Access Detection",
            "pattern": "(?i)(/etc/[^/]*|/etc/.*\\.(conf|config|ini|log|passwd|shadow|group|gshadow|hosts|resolv|fstab|mtab|profile|bashrc|ssh/|ssl/|apache2/|nginx/|mysql/|postgresql/))",
            "action": "block",
            "enabled": true,
            "description": "Detects attempts to access system files in /etc directory"
        },
        {
            "id": "NULL_BYTE_1",
            "name": "Null Byte Detection",
            "pattern": "(?i)(%00|\\x00|\\0|%u0000|%252500|%c0%80|%ef%bf%bd|%ef%bf%be|%ef%bf%bf)",
            "action": "block",
            "enabled": true,
            "description": "Detects null byte injection attempts"
        },
        {
            "id": "XSS_1",
            "name": "Cross-Site Scripting Detection",
            "pattern": "(?i)(<script|javascript:|onload=|onerror=|onclick=|onmouseover=)",
            "action": "block",
            "enabled": true,
            "description": "Detects XSS attack patterns"
        },
        {
            "id": "PATH_TRAVERSAL_1",
            "name": "Path Traversal Detection",
            "pattern": "(\\.\\./|\\.\\.\\\\|/etc/passwd|/etc/shadow|\\.\\.%2f|\\.\\.%5c)",
            "action": "block",
            "enabled": true,
            "description": "Detects directory traversal attempts"
        },
        {
            "id": "USER_AGENT_SCANNER",
            "name": "Scanner User-Agent Detection",
            "pattern": "(?i)(nikto|sqlmap|nmap|dirb|gobuster|dirbuster|burp|acunetix|nessus|openvas)",
            "action": "block",
            "enabled": true,
            "description": "Blocks known security scanners"
        },
        {
            "id": "LFI_1",
            "name": "Local File Inclusion",
            "pattern": "(?i)(/etc/passwd|/etc/shadow|boot.ini|win.ini|/proc/self/environ)",
            "action": "block",
            "enabled": true,
            "description": "Detects local file inclusion attempts"
        },
        {
            "id": "RFI_1",
            "name": "Remote File Inclusion",
            "pattern": "(?i)(http[s]?://[^\\s]+\\.(php|txt|dat|log|sh|pl|cgi))",
            "action": "block",
            "enabled": true,
            "description": "Detects remote file inclusion attempts"
        },
        {
            "id": "HTTP_METHODS_1",
            "name": "Dangerous HTTP Methods",
            "pattern": "(?i)(TRACE|TRACK|DEBUG)",
            "action": "block",
            "enabled": true,
            "description": "Blocks dangerous HTTP methods"
        },
        {
            "id": "PHP_INJECTION_1",
            "name": "PHP Injection",
            "pattern": "(?i)(php://|base64_decode\\(|eval\\(|assert\\(|preg_replace\\(/e|create_function\\()",
            "action": "block",
            "enabled": true,
            "description": "Detects PHP code injection attempts"
        },
        {
            "id": "CVE_2021_44228",
            "name": "Log4Shell (CVE-2021-44228)",
            "pattern": "(?i)\\$\\{jndi:(ldap[s]?|rmi|dns):",
            "action": "block",
            "enabled": true,
            "description": "Detects Log4Shell exploit attempts"
        },
        {
            "id": "COMMAND_INJECTION_1",
            "name": "Command Injection Detection - Operators",
            "pattern": "(?i)(?:^|\\s)(?:[;&|]|\\|\\||&&|\\x60)(?:\\s|$)",
            "action": "block",
            "enabled": true,
            "description": "Detects command injection operators"
        },
        {
            "id": "COMMAND_INJECTION_2",
            "name": "Command Injection Detection - Functions",
            "pattern": "(?i)(?:^|[\\s;|&\\n\\r]|\\?|%0[aAdD])(?:cmd=)?(?:exec|system|shell_exec|passthru|popen|proc_open|pcntl_exec|eval|assert|call_user_func|include|require|file_get_contents|readfile|fopen)\\s*(?:\\(|%28)",
            "action": "block",
            "enabled": true,
            "description": "Detects command injection function calls"
        },
        {
            "id": "COMMAND_INJECTION_3",
            "name": "Newline and Shell Command Injection",
            "pattern": "(?i)(%0[aAdD]|%5[cC][nNrR]|\\\\n|\\\\r|\\n|\\r).{0,50}(cat|ls|wget|curl|nc|bash|sh|chmod|echo|grep|awk|sed|find|whoami|id|uname|ps|kill|rm|mv|cp|touch|mkdir|pwd|ifconfig|netstat|ping|traceroute|nslookup|dig|host|which|whereis|locate|tail|head|more|less|vi|vim|nano|python|perl|ruby|php|node|java)(?:\\s|%20|\\+|$)",
            "action": "block",
            "enabled": true,
            "description": "Detects newline/carriage return injection followed by shell commands"
        },
        {
            "id": "COMMAND_INJECTION_4",
            "name": "Shell Command Detection",
            "pattern": "(?i)(?:^|[;&|\\n\\r`$\\(]|%0[aAdD]|%20|\\s)(cat|ls|wget|curl|nc|bash|sh|chmod|echo|grep|awk|sed|find|whoami|id|uname|ps|kill|rm|mv|cp|touch|mkdir|pwd|ifconfig|ip|netstat|ss|ping|traceroute|nslookup|dig|host|which|whereis|locate|tail|head|more|less|vi|vim|nano|dd|mount|umount|df|du|tar|gzip|gunzip|zip|unzip|python[23]?|perl|ruby|php|node|java|gcc|make|apt|yum|dpkg|rpm|systemctl|service|sudo|su|passwd|useradd|userdel|groupadd|crontab|at|jobs|bg|fg|nohup|screen|tmux)(?:\\s|%20|\\+|/|$)",
            "action": "block",
            "enabled": true,
            "description": "Detects common shell commands in various contexts"
        },
        {
            "id": "CVE_2014_6271",
            "name": "Shellshock (CVE-2014-6271) Detection",
            "pattern": "\\(\\)\\s*\\{[^}]*\\}\\s*;|\\(\\)\\s*\\{\\s*:;\\s*\\}|env\\s+[a-zA-Z_][a-zA-Z0-9_]*=\\s*['\"]?\\(\\)\\s*\\{",
            "action": "block",
            "enabled": true,
            "description": "Detects Shellshock bash vulnerability exploit attempts"
        },
        {
            "id": "BASH_FUNCTION_INJECTION",
            "name": "Bash Function Export Injection",
            "pattern": "(?i)(\\(\\)\\s*\\{|%28%29%20%7B|%28%29%7B|\\\\(\\\\)\\\\{).{0,100}(;|}|%3B|%7D)",
            "action": "block",
            "enabled": true,
            "description": "Detects bash function export injection patterns including encoded variants"
        },
        {
            "id": "COMMAND_INJECTION_5",
            "name": "Shell Binary Path Detection",
            "pattern": "(?i)(/bin/|/usr/bin/|/sbin/|/usr/sbin/|/usr/local/bin/)(bash|sh|zsh|ksh|csh|tcsh|dash|ash|fish|nc|netcat|python|perl|ruby|php|awk|sed|grep|find|xargs|curl|wget|chmod|chown|sudo|su|passwd)",
            "action": "block",
            "enabled": true,
            "description": "Detects direct shell binary path execution attempts"
        },
        {
            "id": "WINDOWS_COMMAND_INJECTION",
            "name": "Windows Command Injection Detection",
            "pattern": "(?i)(?:^|[;&|\\n\\r]|%0[aAdD]|&&|\\|\\||\\s)(dir|type|copy|del|move|ren|md|rd|net|netsh|sc|reg|wmic|tasklist|taskkill|ipconfig|nslookup|ping|tracert|arp|route|shutdown|schtasks|certutil|bitsadmin|mshta|regsvr32|rundll32|cscript|wscript|msiexec|installutil|whoami|hostname|systeminfo|ver|vol|attrib|cacls|icacls|xcopy|robocopy|forfiles|findstr|fc|comp|diskpart|format|chkdsk|sfc|dism)(?:\\s|%20|\\+|/|$)",
            "action": "block",
            "enabled": true,
            "description": "Detects Windows command injection attempts"
        },
        {
            "id": "WINDOWS_PATH_TRAVERSAL",
            "name": "Windows Path and File Access Detection",
            "pattern": "(?i)(C:\\\\|C:/|D:\\\\|D:/|E:\\\\|E:/|%SYSTEMROOT%|%WINDIR%|%TEMP%|%TMP%|%USERPROFILE%|%APPDATA%|%PROGRAMFILES%)(Windows|Users|Program Files|Documents and Settings|System32|SysWOW64|Temp|ProgramData|boot\\.ini|system\\.ini|win\\.ini|hosts|sam|security|software|system)",
            "action": "block",
            "enabled": true,
            "description": "Detects Windows path traversal and sensitive file access attempts"
        },
        {
            "id": "POWERSHELL_INJECTION",
            "name": "PowerShell Injection Detection",
            "pattern": "(?i)(powershell|pwsh|powershell\\.exe|pwsh\\.exe)\\s*(-enc|-encodedcommand|-e|-ec|-command|-c|-file|-f|-nop|-noprofile|-w|-windowstyle|-ep|-executionpolicy|invoke-expression|iex|invoke-command|invoke-item|new-object|start-process|downloadstring|downloadfile)",
            "action": "block",
            "enabled": true,
            "description": "Detects PowerShell injection and obfuscation attempts"
        },
        {
            "id": "CMD_INJECTION",
            "name": "Windows CMD Injection Detection",
            "pattern": "(?i)(cmd\\.exe|cmd|command\\.com|command)\\s*(/c|/k|/q|/v:|/s|/d|/a|/u|/t:|/e:|/f:|/x|/y)",
            "action": "block",
            "enabled": true,
            "description": "Detects Windows CMD shell injection attempts"
        },
        {
            "id": "COMMAND_SUBSTITUTION",
            "name": "Command Substitution Detection",
            "pattern": "(?i)(\\$\\(|%24%28|\\$\\{|%24%7B|`|%60|\\$\\[|%24%5B)",
            "action": "block",
            "enabled": true,
            "description": "Detects command substitution patterns $(), ${}, backticks, and $[]"
        },
        {
            "id": "REMOTE_CODE_EXECUTION",
            "name": "Remote Code Download and Execution",
            "pattern": "(?i)(curl|wget|fetch|nc|netcat|telnet|tftp|ftp)\\s+.{0,50}(http[s]?://|ftp://|tftp://|telnet://|ssh://|scp://|sftp://)",
            "action": "block",
            "enabled": true,
            "description": "Detects attempts to download remote content that could be executed"
        },
        {
            "id": "SUSPICIOUS_DOMAINS",
            "name": "Suspicious Domain Access",
            "pattern": "(?i)(pastebin\\.com|raw\\.githubusercontent\\.com|bit\\.ly|tinyurl\\.com|shorturl\\.at|rebrand\\.ly|is\\.gd|surl\\.li|cli\\.gs|ow\\.ly|t\\.co|goo\\.gl|ngrok\\.io|burpcollaborator\\.net|requestbin\\.com|webhook\\.site|pipedream\\.com|requestcatcher\\.com|postb\\.in|hookb\\.in|\\.duckdns\\.org|\\.no-ip\\.org)",
            "action": "block",
            "enabled": true,
            "description": "Blocks access to commonly abused domains for payload hosting"
        },
        {
            "id": "NESTED_EXECUTION",
            "name": "Nested Command Execution Detection",
            "pattern": "(?i)(\\$\\(.*`.*`.*\\)|`.*\\$\\(.*\\).*`|\\$\\(.*\\$\\(.*\\).*\\)|`.*`.*`)",
            "action": "block",
            "enabled": true,
            "description": "Detects nested command execution patterns"
        },
        {
            "id": "BASH_EXPANSION",
            "name": "Bash Parameter Expansion Detection",
            "pattern": "(?i)(\\$\\{[^}]*:[-+?=]|\\$\\{[^}]*##|\\$\\{[^}]*%%|\\$\\{[^}]*//|\\$\\{!|\\$\\{#)",
            "action": "block",
            "enabled": true,
            "description": "Detects bash parameter expansion that could be used maliciously"
        },
        {
            "id": "ANSI_ESCAPE_SEQUENCES",
            "name": "ANSI Escape Sequence Detection",
            "pattern": "(\\\\033\\[|\\\\x1[bB]\\[|\\\\e\\[|\\x1b\\[|\\033\\[|%1[bB]|\\[\\d+[;\\d]*[mMhHlLABCDJK])",
            "action": "block",
            "enabled": true,
            "description": "Detects ANSI escape sequences used to hide or obfuscate commands"
        },
        {
            "id": "ESCAPE_CHARACTERS",
            "name": "Escape Character Injection",
            "pattern": "(\\\\n|\\\\r|\\\\t|\\\\b|\\\\f|\\\\v|\\\\0|\\\\x[0-9a-fA-F]{2}|\\\\[0-7]{1,3})",
            "action": "block",
            "enabled": true,
            "description": "Detects escape character sequences that could be used for injection"
        },
        {
            "id": "IP_ADDRESS_ACCESS",
            "name": "Direct IP Address Access Detection",
            "pattern": "(?i)(curl|wget|fetch|nc|netcat|telnet|ssh|scp|sftp|ftp)\\s+.{0,50}(http[s]?://)?\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}",
            "action": "block",
            "enabled": true,
            "description": "Detects attempts to access resources via direct IP addresses"
        },
        {
            "id": "TERMINAL_MANIPULATION",
            "name": "Terminal Control Character Detection",
            "pattern": "(\\\\033|\\\\x1[bB]|\\\\e|\\x1b|\\033|%1[bB])(\\[\\d*[;\\d]*[mMhHlLJKABCDEFGST]|\\]\\d+;[^\\007]*\\007|\\(B|\\)0|c|D|E|H|M|N|O|P|Z|\\[\\?\\d+[hl]|\\[\\d+[ABCD]|\\[[0-9;]*m)",
            "action": "block",
            "enabled": true,
            "description": "Detects terminal control sequences used for manipulation or hiding content"
        },
        {
            "id": "OBFUSCATED_COMMANDS",
            "name": "Obfuscated Command Detection",
            "pattern": "(?i)([a-z]{1}[a-z\\\\\"']*[a-z]{1}[a-z\\\\\"']*[a-z]{1}[a-z\\\\\"']*[a-z]{1})\\s*(http[s]?://|ftp://|\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}\\.\\d{1,3})",
            "action": "block",
            "enabled": true,
            "description": "Detects obfuscated commands with escape characters followed by URLs or IPs"
        }
    ]
}