X-Git-Url: http://ftp.carnet.hr/carnet-debian/scm?a=blobdiff_plain;ds=sidebyside;f=debian%2Fossec-hids%2Fvar%2Fossec%2Frules%2Fapache_rules.xml;fp=debian%2Fossec-hids%2Fvar%2Fossec%2Frules%2Fapache_rules.xml;h=0000000000000000000000000000000000000000;hb=946517cefb8751a43a89bda4220221f065f4e5d1;hp=5bb6a7d3586d71f52ac437a29af035d77904e69a;hpb=3f728675941dc69d4e544d3a880a56240a6e394a;p=ossec-hids.git diff --git a/debian/ossec-hids/var/ossec/rules/apache_rules.xml b/debian/ossec-hids/var/ossec/rules/apache_rules.xml deleted file mode 100644 index 5bb6a7d..0000000 --- a/debian/ossec-hids/var/ossec/rules/apache_rules.xml +++ /dev/null @@ -1,325 +0,0 @@ - - - - - - apache-errorlog - Apache messages grouped. - - - - 30100 - ^[error] - Apache error messages grouped. - - - - 30100 - ^[warn] - Apache warn messages grouped. - - - - 30100 - ^[notice] - Apache notice messages grouped. - - - - 30103 - exit signal Segmentation Fault - Apache segmentation fault. - http://www.securityfocus.com/infocus/1633 - service_availability, - - - - 30101 - denied by server configuration - Attempt to access forbidden file or directory. - access_denied, - - - - 30101 - Directory index forbidden by rule - Attempt to access forbidden directory index. - access_denied, - - - - 30101 - Client sent malformed Host header - Code Red attack. - http://www.cert.org/advisories/CA-2001-19.html - CERT: Advisory CA-2001-19 "Code Red" Worm Exploiting Buffer Overflow In IIS Indexing Service DLL - automatic_attack, - - - - 30102 - authentication failed - User authentication failed. - authentication_failed, - - - - 30101 - user \S+ not found|user \S+ in realm \.* not found - Attempt to login using a non-existent user. - invalid_login, - - - - 30101 - authentication failure - User authentication failed. - authentication_failed, - - - - 30101 - File does not exist: | - failed to open stream: No such file or directory| - Failed opening - Attempt to access an non-existent file (those are reported on the access.log). - unknown_resource, - - - - - 30101 - Invalid URI in request - Invalid URI (bad client request). - invalid_request, - - - - 30115 - - Multiple Invalid URI requests from - same source. - invalid_request, - - - - 30101 - File name too long|request failed: URI too long - Invalid URI, file name too long. - invalid_request, - - - - - 30101 - mod_security: Access denied|ModSecurity: Access denied - Access attempt blocked by Mod Security. - access_denied, - - - - 30118 - - Multiple attempts blocked by Mod Security. - access_denied, - - - - 30101 - Resource temporarily unavailable: - Apache without resources to run. - service_availability, - - - - ^mod_security-message: - Modsecurity alert. - - - - 30200 - ^mod_security-message: Access denied - Modsecurity access denied. - access_denied, - - - - 30201 - Multiple attempts blocked by Mod Security. - access_denied, - - - - - 30100 - [\S*:error] - Apache error messages grouped. - - - - 30100 - [\S+:warn] - Apache warn messages grouped. - - - - 30100 - [\S+:notice] - Apache notice messages grouped. - - - - 30303 - exit signal Segmentation Fault - Apache segmentation fault. - http://www.securityfocus.com/infocus/1633 - service_availability, - - - - 30301 - AH01630 - Attempt to access forbidden file or directory. - access_denied, - - - - 30301 - AH01276 - Attempt to access forbidden directory index. - access_denied, - - - - 30301 - AH00550 - Client sent malformed Host header. Possible Code Red attack. - http://www.cert.org/advisories/CA-2001-19.html - CERT: Advisory CA-2001-19 "Code Red" Worm Exploiting Buffer Overflow In IIS Indexing Service DLL - automatic_attack, - - - - 30301 - AH01617|AH01807|AH01694|AH01695|AH02009|AH02010 - User authentication failed. - authentication_failed, - - - - 30301 - AH01618|AH01808|AH01790 - Attempt to login using a non-existent user. - invalid_login, - - - - 30309 - - Multiple authentication failures with invalid user. - authentication_failures, - - - - 30301 - File does not exist: | - failed to open stream: No such file or directory| - Failed opening - Attempt to access an non-existent file (those are reported on the access.log). - unknown_resource, - - - - 30301 - AH00126 - Invalid URI (bad client request). - invalid_request, - - - - 30315 - - Multiple Invalid URI requests from - same source. - invalid_request, - - - - 30301 - AH00565 - Invalid URI, file name too long. - invalid_request, - - - - 30301 - PHP Notice: - PHP Notice in Apache log - - - - 30301 - AH00036 - File name too long: - File name too long. - - - - 30301 - Permission denied: | client denied by server configuration: - Permission denied. - - - - 30301 - AH02811 - script not found - A script cannot be accessed. - - - - - 30301 - ModSecurity: Warning - ModSecurity Warning messages grouped - - - - 30301 - ModSecurity: Access denied - ModSecurity Access denied messages grouped - - - - 30301 - ModSecurity: Audit log: - ModSecurity Audit log messages grouped - - - - 30402 - with code 403 - ModSecurity rejected a query - - - - -