2 - Official Apache rules for OSSEC.
4 - Copyright (C) 2009 Trend Micro Inc.
7 - This program is a free software; you can redistribute it
8 - and/or modify it under the terms of the GNU General Public
9 - License (version 2) as published by the FSF - Free Software
12 - License details: http://www.ossec.net/en/licensing.html
14 - Contributed by: Ahmet Ozturk
18 <group name="apache,">
19 <rule id="30100" level="0">
20 <decoded_as>apache-errorlog</decoded_as>
21 <description>Apache messages grouped.</description>
24 <rule id="30101" level="0">
25 <if_sid>30100</if_sid>
26 <match>^[error] </match>
27 <description>Apache error messages grouped.</description>
30 <rule id="30102" level="0">
31 <if_sid>30100</if_sid>
32 <match>^[warn] </match>
33 <description>Apache warn messages grouped.</description>
36 <rule id="30103" level="0">
37 <if_sid>30100</if_sid>
38 <match>^[notice] </match>
39 <description>Apache notice messages grouped.</description>
42 <rule id="30104" level="12">
43 <if_sid>30103</if_sid>
44 <match>exit signal Segmentation Fault</match>
45 <description>Apache segmentation fault.</description>
46 <info type="link">http://www.securityfocus.com/infocus/1633</info>
47 <group>service_availability,</group>
50 <rule id="30105" level="5">
51 <if_sid>30101</if_sid>
52 <match>denied by server configuration</match>
53 <description>Attempt to access forbidden file or directory.</description>
54 <group>access_denied,</group>
57 <rule id="30106" level="5">
58 <if_sid>30101</if_sid>
59 <match>Directory index forbidden by rule</match>
60 <description>Attempt to access forbidden directory index.</description>
61 <group>access_denied,</group>
64 <rule id="30107" level="6">
65 <if_sid>30101</if_sid>
66 <match>Client sent malformed Host header</match>
67 <description>Code Red attack.</description>
68 <info type="link">http://www.cert.org/advisories/CA-2001-19.html</info>
69 <info type="text">CERT: Advisory CA-2001-19 "Code Red" Worm Exploiting Buffer Overflow In IIS Indexing Service DLL</info>
70 <group>automatic_attack,</group>
73 <rule id="30108" level="5">
74 <if_sid>30102</if_sid>
75 <match>authentication failed</match>
76 <description>User authentication failed.</description>
77 <group>authentication_failed,</group>
80 <rule id="30109" level="9">
81 <if_sid>30101</if_sid>
82 <regex>user \S+ not found</regex>
83 <description>Attempt to login using a non-existent user.</description>
84 <group>invalid_login,</group>
87 <rule id="30110" level="5">
88 <if_sid>30101</if_sid>
89 <match>authentication failure</match>
90 <description>User authentication failed.</description>
91 <group>authentication_failed,</group>
94 <rule id="30112" level="0">
95 <if_sid>30101</if_sid>
96 <match>File does not exist: |</match>
97 <match>failed to open stream: No such file or directory|</match>
98 <match>Failed opening </match>
99 <description>Attempt to access an non-existent file (those are reported on the access.log).</description>
100 <group>unknown_resource,</group>
103 <!-- [Tue Mar 07 12:05:15 2006] [error] [client 200.206.165.91] Invalid URI in request %3Bi%3A3%3Bi%3A0%3B%7D; usercookie[password]=d6ed9e1750d0b2aba6b3311cbec087d8; 45befd35f8a0f47b89ed8831f892b8dc=167c4e46a940cd2570b952eea527b27a; PHPSESSID=616hjdg7kj9bln37efsv7vt7g3
104 - [client 65.204.137.200] script '/var/www/html/xmlrpc.php' not found or unable to stat
106 <rule id="30115" level="5">
107 <if_sid>30101</if_sid>
108 <match>Invalid URI in request</match>
109 <description>Invalid URI (bad client request).</description>
110 <group>invalid_request,</group>
113 <rule id="30116" level="10" frequency="8" timeframe="120">
114 <if_matched_sid>30115</if_matched_sid>
116 <description>Multiple Invalid URI requests from </description>
117 <description>same source.</description>
118 <group>invalid_request,</group>
121 <rule id="30117" level="10">
122 <if_sid>30101</if_sid>
123 <match>File name too long|request failed: URI too long</match>
124 <description>Invalid URI, file name too long.</description>
125 <group>invalid_request,</group>
128 <!-- Mod security rules by <ossec ( at ) sioban.net -->
129 <rule id="30118" level="6">
130 <if_sid>30101</if_sid>
131 <match>mod_security: Access denied|ModSecurity: Access denied</match>
132 <description>Access attempt blocked by Mod Security.</description>
133 <group>access_denied,</group>
136 <rule id="30119" level="12" frequency="6" timeframe="120">
137 <if_matched_sid>30118</if_matched_sid>
139 <description>Multiple attempts blocked by Mod Security.</description>
140 <group>access_denied,</group>
143 <rule id="30120" level="12">
144 <if_sid>30101</if_sid>
145 <match>Resource temporarily unavailable:</match>
146 <description>Apache without resources to run.</description>
147 <group>service_availability,</group>
150 <rule id="30200" level="6" noalert="1">
151 <match>^mod_security-message: </match>
152 <description>Modsecurity alert.</description>
155 <rule id="30201" level="6">
156 <if_sid>30200</if_sid>
157 <match>^mod_security-message: Access denied </match>
158 <description>Modsecurity access denied.</description>
159 <group>access_denied,</group>
162 <rule id="30202" level="10" frequency="8" timeframe="120">
163 <if_matched_sid>30201</if_matched_sid>
164 <description>Multiple attempts blocked by Mod Security.</description>
165 <group>access_denied,</group>
167 </group> <!-- ERROR_LOG,APACHE -->