CDN WAF-Regelsammlung

Die Web Application Firewall von STACKIT CDN nutzt das OWASP Core Rule Set (CRS), um generischen Schutz gegen ein breites Spektrum von Angriffen zu bieten, einschließlich der OWASP Top 10, bei minimalen Fehlalarmen.

Regeln werden in Request-Regeln (Prüfung des eingehenden Traffics) und Response-Regeln (Prüfung des ausgehenden Traffics zur Verhinderung von Datenlecks) unterteilt.

OWASP CRS Request-Regeln

Diese Regeln prüfen eingehende Client-Anfragen, um böswillige Absichten zu erkennen und zu blockieren, bevor sie Ihren Origin erreichen.

Regelgruppe: 911 – Method Enforcement

Erzwingt HTTP-Methoden-Richtlinien, um sicherzustellen, dass nur zugelassene Methoden (z. B. GET, POST) verwendet werden.

Code	Regel
911100	Method is not allowed by policy

Regelgruppe: 913 – Scanner Detection

Identifiziert und blockiert bekannte Sicherheitstools, Schwachstellen-Scanner und Crawler.

Code	Regel
913100	Found User-Agent associated with security scanner

Regelgruppe: 921 – Protocol Attack

Zielt auf Angriffe ab, die das HTTP-Protokoll ausnutzen, wie Request Smuggling und Header Injection.

Code	Regel
921110	HTTP Request Smuggling Attack
921120	HTTP Response Splitting Attack
921130	HTTP Response Splitting Attack
921140	HTTP Header Injection Attack via headers
921150	HTTP Header Injection Attack via payload (CR/LF detected)
921160	HTTP Header Injection Attack via payload (CR/LF and header-name detected)
921190	HTTP Splitting (CR/LF in request filename detected)
921200	LDAP Injection Attack
921421	Content-Type header: Dangerous content type outside the mime type declaration
921240	mod_proxy attack attempt detected
921151	HTTP Header Injection Attack via payload (CR/LF detected)
921422	Content-Type header: Dangerous content type outside the mime type declaration
921230	HTTP Range Header detected
921180	HTTP Parameter Pollution (%\{TX.1\})
921210	HTTP Parameter Pollution after detecting bogus char after parameter array
921220	HTTP Parameter Pollution possible via array notation

Regelgruppe: 922 – Multipart Attack

Validiert multipart/form-data-Anfragen, die häufig für Datei-Uploads verwendet werden.

Code	Regel
922100	Multipart content type global _charset_ definition is not allowed by policy
922110	Illegal MIME Multipart Header content-type: charset parameter
922120	Content-Transfer-Encoding was deprecated by rfc7578 in 2015 and should not be used

Regelgruppe: 930 – Local File Inclusion (LFI)

Verhindert, dass Angreifer über Path Traversal auf sensible Dateien auf dem Server zugreifen.

Code	Regel
930100	Path Traversal Attack (/../) or (/…/)
930110	Path Traversal Attack (/../) or (/…/)
930120	OS File Access Attempt
930130	Restricted File Access Attempt
930121	OS File Access Attempt in REQUEST_HEADERS

Regelgruppe: 931 – Remote File Inclusion (RFI)

Blockiert Versuche, schädlichen Remote-Code innerhalb der Anwendung einzubinden und auszuführen.

Code	Regel
931100	Possible Remote File Inclusion (RFI) Attack: URL Parameter using IP Address
931110	Possible Remote File Inclusion (RFI) Attack: Common RFI Vulnerable Parameter Name used w/URL Payload
931120	Possible Remote File Inclusion (RFI) Attack: URL Payload Used w/Trailing Question Mark Character (?)
931130	Possible Remote File Inclusion (RFI) Attack: Off-Domain Reference/Link
931131	Possible Remote File Inclusion (RFI) Attack: Off-Domain Reference/Link

Regelgruppe: 932 – Remote Code Execution (RCE)

Schützt vor der Ausführung beliebiger Systembefehle (Unix/Windows-Shell) auf dem Origin-Server.

Code	Rule
932230	Remote Command Execution: Unix Command Injection (2-3 chars)
932235	Remote Command Execution: Unix Command Injection (command without evasion)
932120	Remote Command Execution: Windows PowerShell Command Found
932125	Remote Command Execution: Windows Powershell Alias Command Injection
932130	Remote Command Execution: Unix Shell Expression Found
932140	Remote Command Execution: Windows FOR/IF Command Found
932250	Remote Command Execution: Direct Unix Command Execution
932260	Remote Command Execution: Direct Unix Command Execution
932330	Remote Command Execution: Unix shell history invocation
932160	Remote Command Execution: Unix Shell Code Found
932170	Remote Command Execution: Shellshock (CVE-2014-6271)
932171	Remote Command Execution: Shellshock (CVE-2014-6271)
932175	Remote Command Execution: Unix shell alias invocation
932180	Restricted File Upload Attempt
932370	Remote Command Execution: Windows Command Injection
932380	Remote Command Execution: Windows Command Injection
932231	Remote Command Execution: Unix Command Injection
932131	Remote Command Execution: Unix Shell Expression Found
932200	RCE Bypass Technique
932205	RCE Bypass Technique
932206	RCE Bypass Technique
932220	Remote Command Execution: Unix Command Injection with pipe
932240	Remote Command Execution: Unix Command Injection evasion attempt detected
932210	Remote Command Execution: SQLite System Command Execution
932300	Remote Command Execution: SMTP Command Execution
932310	Remote Command Execution: IMAP Command Execution
932320	Remote Command Execution: POP3 Command Execution
932236	Remote Command Execution: Unix Command Injection (command without evasion)
932239	Remote Command Execution: Unix Command Injection found in user-agent or referer header
932161	Remote Command Execution: Unix Shell Code Found in REQUEST_HEADERS
932232	Remote Command Execution: Unix Command Injection
932237	Remote Command Execution: Unix Shell Code Found in REQUEST_HEADERS
932238	Remote Command Execution: Unix Shell Code Found in REQUEST_HEADERS
932190	Remote Command Execution: Wildcard bypass technique attempt
932301	Remote Command Execution: SMTP Command Execution
932311	Remote Command Execution: IMAP Command Execution
932321	Remote Command Execution: POP3 Command Execution
932331	Remote Command Execution: Unix shell history invocation

Regelgruppe: 933 – PHP Injection

Spezifische Schutzmaßnahmen für PHP-basierte Anwendungen, die auf Script-Injections und Konfigurationsänderungen abzielen.

Code	Rule
933100	PHP Injection Attack: PHP Open Tag Found
933110	PHP Injection Attack: PHP Script File Upload Found
933120	PHP Injection Attack: Configuration Directive Found
933130	PHP Injection Attack: Variables Found
933140	PHP Injection Attack: I/O Stream Found
933200	PHP Injection Attack: Wrapper scheme detected
933150	PHP Injection Attack: High-Risk PHP Function Name Found
933160	PHP Injection Attack: High-Risk PHP Function Call Found
933170	PHP Injection Attack: Serialized Object Injection
933180	PHP Injection Attack: Variable Function Call Found
933210	PHP Injection Attack: Variable Function Call Found
933151	PHP Injection Attack: Medium-Risk PHP Function Name Found
933131	PHP Injection Attack: Variables Found
933161	PHP Injection Attack: Low-Value PHP Function Call Found
933111	PHP Injection Attack: PHP Script File Upload Found
933190	PHP Injection Attack: PHP Closing Tag Found
933211	PHP Injection Attack: Variable Function Call Found

Regelgruppe: 934 – Generische Anwendungsangriffe

Deckt eine Vielzahl moderner Anwendungsangriffe ab, darunter Node.js-Injection, SSRF und Prototype Pollution.

Code	Rule
934100	Node.js Injection Attack 1/2
934110	Possible Server Side Request Forgery (SSRF) Attack: Cloud provider metadata URL in Parameter
934130	JavaScript Prototype Pollution
934150	Ruby Injection Attack
934160	Node.js DoS attack
934170	PHP data scheme attack
934101	Node.js Injection Attack 2/2
934120	Possible Server Side Request Forgery (SSRF) Attack: URL Parameter using IP Address
934140	Perl Injection Attack
934100	Node.js Injection Attack

Regelgruppe: 941 – Cross-Site Scripting (XSS)

Erkennt Skripte, die in Webseiten eingeschleust werden, um im Browser des Endbenutzers ausgeführt zu werden.

Code	Rule
941100	XSS Attack Detected via libinjection
941110	XSS Filter - Category 1: Script Tag Vector
941130	XSS Filter - Category 3: Attribute Vector
941140	XSS Filter - Category 4: Javascript URI Vector
941160	NoScript XSS InjectionChecker: HTML Injection
941170	NoScript XSS InjectionChecker: Attribute Injection
941180	Node-Validator Deny List Keywords
941190	IE XSS Filters - Attack Detected
941200	IE XSS Filters - Attack Detected
941210	IE XSS Filters - Attack Detected
941220	IE XSS Filters - Attack Detected
941230	IE XSS Filters - Attack Detected
941240	IE XSS Filters - Attack Detected
941250	IE XSS Filters - Attack Detected
941260	IE XSS Filters - Attack Detected
941270	IE XSS Filters - Attack Detected
941280	IE XSS Filters - Attack Detected
941290	IE XSS Filters - Attack Detected
941300	IE XSS Filters - Attack Detected
941310	US-ASCII Malformed Encoding XSS Filter - Attack Detected
941350	UTF-7 Encoding IE XSS - Attack Detected
941360	JSFuck / Hieroglyphy obfuscation detected
941370	JavaScript global variable found
941390	Javascript method detected
941400	XSS JavaScript function without parentheses
941101	XSS Attack Detected via libinjection
941120	XSS Filter - Category 2: Event Handler Vector
941150	XSS Filter - Category 5: Disallowed HTML Attributes
941181	Node-Validator Deny List Keywords
941320	Possible XSS Attack Detected - HTML Tag Handler
941330	IE XSS Filters - Attack Detected
941340	IE XSS Filters - Attack Detected
941380	AngularJS client side template injection detected

Regelgruppe: 942 – SQL Injection (SQLi)

Umfassender Schutz gegen SQL-Injection-Versuche, einschließlich Blind SQLi und datenbankspezifischer Payloads.

Code	Rule
942100	SQL Injection Attack Detected via libinjection
942140	SQL Injection Attack: Common DB Names Detected
942151	SQL Injection Attack: SQL function name detected
942160	Detects blind sqli tests using sleep() or benchmark()
942170	Detects SQL benchmark and sleep injection attempts including conditional queries
942190	Detects MSSQL code execution and information gathering attempts
942220	Looking for integer overflow attacks, magic number crash
942230	Detects conditional SQL injection attempts
942240	Detects MySQL charset switch and MSSQL DoS attempts
942250	Detects MATCH AGAINST, MERGE and EXECUTE IMMEDIATE injections
942270	Looking for basic SQL injection. Common attack string for mysql, oracle and others
942280	Detects Postgres pg_sleep injection, waitfor delay attacks
942290	Finds basic MongoDB SQL injection attempts
942320	Detects MySQL and PostgreSQL stored procedure/function injections
942350	Detects MySQL UDF injection and other data/structure manipulation attempts
942360	Detects concatenated basic SQL injection and SQLLFI attempts
942500	MySQL in-line comment detected
942540	SQL Authentication bypass (split query)
942560	MySQL Scientific Notation payload detected
942550	JSON-Based SQL Injection
942120	SQL Injection Attack: SQL Operator Detected
942130	SQL Injection Attack: SQL Boolean-based attack detected
942131	SQL Injection Attack: SQL Boolean-based attack detected
942150	SQL Injection Attack: SQL function name detected
942180	Detects basic SQL authentication bypass attempts 1/3
942200	Detects MySQL comment-/space-obfuscated injections and backtick termination
942210	Detects chained SQL injection attempts 1/2
942260	Detects basic SQL authentication bypass attempts 2/3
942300	Detects MySQL comments, conditions and ch(a)r injections
942310	Detects chained SQL injection attempts 2/2
942330	Detects classic SQL injection probings 1/3
942340	Detects basic SQL authentication bypass attempts 3/3
942361	Detects basic SQL injection based on keyword alter or union
942362	Detects concatenated basic SQL injection and SQLLFI attempts
942370	Detects classic SQL injection probings 2/3
942380	SQL Injection Attack
942390	SQL Injection Attack
942400	SQL Injection Attack
942410	SQL Injection Attack
942470	SQL Injection Attack
942480	SQL Injection Attack
942430	Restricted SQL Character Anomaly Detection (args): # of special characters exceeded (12)
942440	SQL Comment Sequence Detected
942450	SQL Hex Encoding Identified
942510	SQLi bypass attempt by ticks or backticks detected
942520	Detects basic SQL authentication bypass attempts 4.0/4
942521	Detects basic SQL authentication bypass attempts 4.1/4
942522	Detects basic SQL authentication bypass attempts 4.1/4
942101	SQL Injection Attack Detected via libinjection
942152	SQL Injection Attack: SQL function name detected
942321	Detects MySQL and PostgreSQL stored procedure/function injections
942251	Detects HAVING injections
942490	Detects classic SQL injection probings 3/3
942420	Restricted SQL Character Anomaly Detection (cookies): # of special characters exceeded (8)
942431	Restricted SQL Character Anomaly Detection (args): # of special characters exceeded (6)
942460	Meta-Character Anomaly Detection Alert - Repetitive Non-Word Characters
942511	SQLi bypass attempt by ticks detected
942530	SQLi query termination detected
942421	Restricted SQL Character Anomaly Detection (cookies): # of special characters exceeded (3)

Regelgruppe: 943 – Session Fixation

Verhindert, dass Angreifer Benutzersitzungen kapern, indem sie eine bekannte Session-ID erzwingen.

Code	Rule
943100	Possible Session Fixation Attack: Setting Cookie Values in HTML
943110	Possible Session Fixation Attack: SessionID Parameter Name with Off-Domain Referer
943120	Possible Session Fixation Attack: SessionID Parameter Name with No Referer

Regelgruppe: 944 – Java Injection

Zielt auf Java-spezifische Schwachstellen ab, einschließlich Serialisierungsangriffe und Log4shell.

Code	Rule
944100	Remote Command Execution: Suspicious Java class detected
944110	Remote Command Execution: Java process spawn (CVE-2017-9805)
944120	Remote Command Execution: Java serialization (CVE-2015-4852)
944130	Suspicious Java class detected
944140	Java Injection Attack: Java Script File Upload Found
944150	Potential Remote Command Execution: Log4j / Log4shell
944151	Potential Remote Command Execution: Log4j / Log4shell
944200	Magic bytes Detected, probable java serialization in use
944210	Magic bytes Detected Base64 Encoded, probable java serialization in use
944240	Remote Command Execution: Java serialization (CVE-2015-4852)
944250	Remote Command Execution: Suspicious Java method detected
944260	Remote Command Execution: Malicious class-loading payload
944300	Base64 encoded string matched suspicious keyword
944152	Potential Remote Command Execution: Log4j / Log4shell

OWASP CRS Response-Regeln

Diese Regeln prüfen den ausgehenden Traffic von Ihrem Origin, um zu verhindern, dass sensible Informationen an Benutzer oder Angreifer weitergegeben werden.

Regelgruppe: 950 – Allgemeine Datenlecks

Blockiert Antworten, die Verzeichnislisten, Quellcode oder Anwendungsfehlermeldungen enthalten.

Code	Rule
950130	Directory Listing
950140	CGI source code leakage
950100	The Application Returned a 500-Level Status Code

Regelgruppe: 951 – Datenbank-Informationslecks

Verhindert, dass datenbankspezifische Fehlermeldungen Ihre Backend-Architektur offenlegen.

Code	Rule
951110	Microsoft Access SQL Information Leakage
951120	Oracle SQL Information Leakage
951130	DB2 SQL Information Leakage
951140	EMC SQL Information Leakage
951150	firebird SQL Information Leakage
951160	Frontbase SQL Information Leakage
951170	hsqldb SQL Information Leakage
951180	informix SQL Information Leakage
951190	ingres SQL Information Leakage
951200	interbase SQL Information Leakage
951210	maxDB SQL Information Leakage
951220	mssql SQL Information Leakage
951230	mysql SQL Information Leakage
951240	postgres SQL Information Leakage
951250	sqlite SQL Information Leakage
951260	Sybase SQL Information Leakage

Regelgruppe: 952 – Java-Informationslecks

Blockiert die Offenlegung von Java-Quellcode oder Stack Traces.

Code	Rule
952100	Java Source Code Leakage
952110	Java Errors

Regelgruppe: 953 – PHP-Informationslecks

Verhindert die Offenlegung von PHP-Quellcode oder internen Informationen.

Code	Rule
953100	PHP Information Leakage
953110	PHP source code leakage
953120	PHP source code leakage
953101	PHP Information Leakage

Regelgruppe: 954 – IIS-Informationslecks

Zielt auf Informationsoffenlegungen ab, die spezifisch für Microsoft Internet Information Services (IIS) sind.

Code	Rule
954100	Disclosure of IIS install location
954110	Application Availability Error
954120	IIS Information Leakage
954130	IIS Information Leakage

Regelgruppe: 955 – Web Shells

Erkennt Muster, die mit gängigen Web Shells (Backdoors) verbunden sind und Remote-Administration ermöglichen.

Code	Rule
955100	Web shell detected
955110	r57 web shell
955120	WSO web shell
955130	b4tm4n web shell
955140	Mini Shell web shell
955150	Ashiyane web shell
955160	Symlink_Sa web shell
955170	CasuS web shell
955180	GRP WebShell
955190	NGHshell web shell
955200	SimAttacker web shell
955210	Unknown web shell
955220	lama’s’hell web shell
955230	lostDC web shell
955240	Unknown web shell
955250	Unknown web shell
955260	Ru24PostWebShell web shell
955270	s72 Shell web shell
955280	PhpSpy web shell
955290	g00nshell web shell
955300	PuNkHoLic shell web shell
955310	azrail web shell
955320	SmEvK_PaThAn Shell web shell
955330	Shell I web shell
955340	b374k m1n1 web shell
955350	webadmin.php file manager