X-Git-Url: http://ftp.carnet.hr/carnet-debian/scm?p=ossec-hids.git;a=blobdiff_plain;f=debian%2Fossec-hids%2Fvar%2Fossec%2Frules%2Fapache_rules.xml;fp=debian%2Fossec-hids%2Fvar%2Fossec%2Frules%2Fapache_rules.xml;h=5bb6a7d3586d71f52ac437a29af035d77904e69a;hp=0000000000000000000000000000000000000000;hb=3f728675941dc69d4e544d3a880a56240a6e394a;hpb=927951d1c1ad45ba9e7325f07d996154a91c911b diff --git a/debian/ossec-hids/var/ossec/rules/apache_rules.xml b/debian/ossec-hids/var/ossec/rules/apache_rules.xml new file mode 100644 index 0000000..5bb6a7d --- /dev/null +++ b/debian/ossec-hids/var/ossec/rules/apache_rules.xml @@ -0,0 +1,325 @@ + + + + + + apache-errorlog + Apache messages grouped. + + + + 30100 + ^[error] + Apache error messages grouped. + + + + 30100 + ^[warn] + Apache warn messages grouped. + + + + 30100 + ^[notice] + Apache notice messages grouped. + + + + 30103 + exit signal Segmentation Fault + Apache segmentation fault. + http://www.securityfocus.com/infocus/1633 + service_availability, + + + + 30101 + denied by server configuration + Attempt to access forbidden file or directory. + access_denied, + + + + 30101 + Directory index forbidden by rule + Attempt to access forbidden directory index. + access_denied, + + + + 30101 + Client sent malformed Host header + Code Red attack. + http://www.cert.org/advisories/CA-2001-19.html + CERT: Advisory CA-2001-19 "Code Red" Worm Exploiting Buffer Overflow In IIS Indexing Service DLL + automatic_attack, + + + + 30102 + authentication failed + User authentication failed. + authentication_failed, + + + + 30101 + user \S+ not found|user \S+ in realm \.* not found + Attempt to login using a non-existent user. + invalid_login, + + + + 30101 + authentication failure + User authentication failed. + authentication_failed, + + + + 30101 + File does not exist: | + failed to open stream: No such file or directory| + Failed opening + Attempt to access an non-existent file (those are reported on the access.log). + unknown_resource, + + + + + 30101 + Invalid URI in request + Invalid URI (bad client request). + invalid_request, + + + + 30115 + + Multiple Invalid URI requests from + same source. + invalid_request, + + + + 30101 + File name too long|request failed: URI too long + Invalid URI, file name too long. + invalid_request, + + + + + 30101 + mod_security: Access denied|ModSecurity: Access denied + Access attempt blocked by Mod Security. + access_denied, + + + + 30118 + + Multiple attempts blocked by Mod Security. + access_denied, + + + + 30101 + Resource temporarily unavailable: + Apache without resources to run. + service_availability, + + + + ^mod_security-message: + Modsecurity alert. + + + + 30200 + ^mod_security-message: Access denied + Modsecurity access denied. + access_denied, + + + + 30201 + Multiple attempts blocked by Mod Security. + access_denied, + + + + + 30100 + [\S*:error] + Apache error messages grouped. + + + + 30100 + [\S+:warn] + Apache warn messages grouped. + + + + 30100 + [\S+:notice] + Apache notice messages grouped. + + + + 30303 + exit signal Segmentation Fault + Apache segmentation fault. + http://www.securityfocus.com/infocus/1633 + service_availability, + + + + 30301 + AH01630 + Attempt to access forbidden file or directory. + access_denied, + + + + 30301 + AH01276 + Attempt to access forbidden directory index. + access_denied, + + + + 30301 + AH00550 + Client sent malformed Host header. Possible Code Red attack. + http://www.cert.org/advisories/CA-2001-19.html + CERT: Advisory CA-2001-19 "Code Red" Worm Exploiting Buffer Overflow In IIS Indexing Service DLL + automatic_attack, + + + + 30301 + AH01617|AH01807|AH01694|AH01695|AH02009|AH02010 + User authentication failed. + authentication_failed, + + + + 30301 + AH01618|AH01808|AH01790 + Attempt to login using a non-existent user. + invalid_login, + + + + 30309 + + Multiple authentication failures with invalid user. + authentication_failures, + + + + 30301 + File does not exist: | + failed to open stream: No such file or directory| + Failed opening + Attempt to access an non-existent file (those are reported on the access.log). + unknown_resource, + + + + 30301 + AH00126 + Invalid URI (bad client request). + invalid_request, + + + + 30315 + + Multiple Invalid URI requests from + same source. + invalid_request, + + + + 30301 + AH00565 + Invalid URI, file name too long. + invalid_request, + + + + 30301 + PHP Notice: + PHP Notice in Apache log + + + + 30301 + AH00036 + File name too long: + File name too long. + + + + 30301 + Permission denied: | client denied by server configuration: + Permission denied. + + + + 30301 + AH02811 + script not found + A script cannot be accessed. + + + + + 30301 + ModSecurity: Warning + ModSecurity Warning messages grouped + + + + 30301 + ModSecurity: Access denied + ModSecurity Access denied messages grouped + + + + 30301 + ModSecurity: Audit log: + ModSecurity Audit log messages grouped + + + + 30402 + with code 403 + ModSecurity rejected a query + + + + +