WAF rule collection

The STACKIT Web Application Firewall (WAF) utilizes the OWASP Core Rule Set (CRS) to provide generic protection against a broad range of attacks, including the OWASP Top 10, with minimum false alerts.

Rules are categorized into request rules (inspecting incoming traffic) and response rules (inspecting outgoing traffic to prevent data leakage).

OWASP CRS request rules

These rules inspect incoming client requests to identify and block malicious intent before it reaches your origin.

Rule group: 911 - Method Enforcement

Enforces HTTP method policies to ensure only approved methods (e.g., GET, POST) are used.

Code	Rule
911100	Method is not allowed by policy

Rule group: 913 - Scanner Detection

Identifies and blocks known security tools, vulnerability scanners, and crawlers.

Code	Rule
913100	Found User-Agent associated with security scanner

Rule group: 921 - Protocol Attack

Targets attacks that exploit the HTTP protocol, such as request smuggling and header injection.

Code	Rule
921110	HTTP Request Smuggling Attack
921120	HTTP Response Splitting Attack
921130	HTTP Response Splitting Attack
921140	HTTP Header Injection Attack via headers
921150	HTTP Header Injection Attack via payload (CR/LF detected)
921160	HTTP Header Injection Attack via payload (CR/LF and header-name detected)
921190	HTTP Splitting (CR/LF in request filename detected)
921200	LDAP Injection Attack
921421	Content-Type header: Dangerous content type outside the mime type declaration
921240	mod_proxy attack attempt detected
921151	HTTP Header Injection Attack via payload (CR/LF detected)
921422	Content-Type header: Dangerous content type outside the mime type declaration
921230	HTTP Range Header detected
921180	HTTP Parameter Pollution (%\{TX.1\})
921210	HTTP Parameter Pollution after detecting bogus char after parameter array
921220	HTTP Parameter Pollution possible via array notation

Rule group: 922 - Multipart Attack

Validates multipart/form-data requests, often used for file uploads.

Code	Rule
922100	Multipart content type global _charset_ definition is not allowed by policy
922110	Illegal MIME Multipart Header content-type: charset parameter
922120	Content-Transfer-Encoding was deprecated by rfc7578 in 2015 and should not be used

Rule group: 930 - Local File Inclusion (LFI)

Prevents attackers from accessing sensitive files on the server through path traversal.

Code	Rule
930100	Path Traversal Attack (/../) or (/…/)
930110	Path Traversal Attack (/../) or (/…/)
930120	OS File Access Attempt
930130	Restricted File Access Attempt
930121	OS File Access Attempt in REQUEST_HEADERS

Rule group: 931 - Remote File Inclusion (RFI)

Blocks attempts to include and execute remote malicious code within the application.

Code	Rule
931100	Possible Remote File Inclusion (RFI) Attack: URL Parameter using IP Address
931110	Possible Remote File Inclusion (RFI) Attack: Common RFI Vulnerable Parameter Name used w/URL Payload
931120	Possible Remote File Inclusion (RFI) Attack: URL Payload Used w/Trailing Question Mark Character (?)
931130	Possible Remote File Inclusion (RFI) Attack: Off-Domain Reference/Link
931131	Possible Remote File Inclusion (RFI) Attack: Off-Domain Reference/Link

Rule group: 932 - Remote Code Execution (RCE)

Protects against the execution of arbitrary system commands (Unix/Windows shell) on the origin server.

Code	Rule
932230	Remote Command Execution: Unix Command Injection (2-3 chars)
932235	Remote Command Execution: Unix Command Injection (command without evasion)
932120	Remote Command Execution: Windows PowerShell Command Found
932125	Remote Command Execution: Windows Powershell Alias Command Injection
932130	Remote Command Execution: Unix Shell Expression Found
932140	Remote Command Execution: Windows FOR/IF Command Found
932250	Remote Command Execution: Direct Unix Command Execution
932260	Remote Command Execution: Direct Unix Command Execution
932330	Remote Command Execution: Unix shell history invocation
932160	Remote Command Execution: Unix Shell Code Found
932170	Remote Command Execution: Shellshock (CVE-2014-6271)
932171	Remote Command Execution: Shellshock (CVE-2014-6271)
932175	Remote Command Execution: Unix shell alias invocation
932180	Restricted File Upload Attempt
932370	Remote Command Execution: Windows Command Injection
932380	Remote Command Execution: Windows Command Injection
932231	Remote Command Execution: Unix Command Injection
932131	Remote Command Execution: Unix Shell Expression Found
932200	RCE Bypass Technique
932205	RCE Bypass Technique
932206	RCE Bypass Technique
932220	Remote Command Execution: Unix Command Injection with pipe
932240	Remote Command Execution: Unix Command Injection evasion attempt detected
932210	Remote Command Execution: SQLite System Command Execution
932300	Remote Command Execution: SMTP Command Execution
932310	Remote Command Execution: IMAP Command Execution
932320	Remote Command Execution: POP3 Command Execution
932236	Remote Command Execution: Unix Command Injection (command without evasion)
932239	Remote Command Execution: Unix Command Injection found in user-agent or referer header
932161	Remote Command Execution: Unix Shell Code Found in REQUEST_HEADERS
932232	Remote Command Execution: Unix Command Injection
932237	Remote Command Execution: Unix Shell Code Found in REQUEST_HEADERS
932238	Remote Command Execution: Unix Shell Code Found in REQUEST_HEADERS
932190	Remote Command Execution: Wildcard bypass technique attempt
932301	Remote Command Execution: SMTP Command Execution
932311	Remote Command Execution: IMAP Command Execution
932321	Remote Command Execution: POP3 Command Execution
932331	Remote Command Execution: Unix shell history invocation

Rule group: 933 - PHP Injection

Specific protections for PHP-based applications, targeting script injections and configuration changes.

Code	Rule
933100	PHP Injection Attack: PHP Open Tag Found
933110	PHP Injection Attack: PHP Script File Upload Found
933120	PHP Injection Attack: Configuration Directive Found
933130	PHP Injection Attack: Variables Found
933140	PHP Injection Attack: I/O Stream Found
933200	PHP Injection Attack: Wrapper scheme detected
933150	PHP Injection Attack: High-Risk PHP Function Name Found
933160	PHP Injection Attack: High-Risk PHP Function Call Found
933170	PHP Injection Attack: Serialized Object Injection
933180	PHP Injection Attack: Variable Function Call Found
933210	PHP Injection Attack: Variable Function Call Found
933151	PHP Injection Attack: Medium-Risk PHP Function Name Found
933131	PHP Injection Attack: Variables Found
933161	PHP Injection Attack: Low-Value PHP Function Call Found
933111	PHP Injection Attack: PHP Script File Upload Found
933190	PHP Injection Attack: PHP Closing Tag Found
933211	PHP Injection Attack: Variable Function Call Found

Rule group: 934 - Generic Application Attacks

Covers a variety of modern application attacks including Node.js injection, SSRF, and Prototype Pollution.

Code	Rule
934100	Node.js Injection Attack 1/2
934110	Possible Server Side Request Forgery (SSRF) Attack: Cloud provider metadata URL in Parameter
934130	JavaScript Prototype Pollution
934150	Ruby Injection Attack
934160	Node.js DoS attack
934170	PHP data scheme attack
934101	Node.js Injection Attack 2/2
934120	Possible Server Side Request Forgery (SSRF) Attack: URL Parameter using IP Address
934140	Perl Injection Attack
934100	Node.js Injection Attack

Rule group: 941 - Cross-Site Scripting (XSS)

Detects scripts injected into web pages to be executed by the end user’s browser.

Code	Rule
941100	XSS Attack Detected via libinjection
941110	XSS Filter - Category 1: Script Tag Vector
941130	XSS Filter - Category 3: Attribute Vector
941140	XSS Filter - Category 4: Javascript URI Vector
941160	NoScript XSS InjectionChecker: HTML Injection
941170	NoScript XSS InjectionChecker: Attribute Injection
941180	Node-Validator Deny List Keywords
941190	IE XSS Filters - Attack Detected
941200	IE XSS Filters - Attack Detected
941210	IE XSS Filters - Attack Detected
941220	IE XSS Filters - Attack Detected
941230	IE XSS Filters - Attack Detected
941240	IE XSS Filters - Attack Detected
941250	IE XSS Filters - Attack Detected
941260	IE XSS Filters - Attack Detected
941270	IE XSS Filters - Attack Detected
941280	IE XSS Filters - Attack Detected
941290	IE XSS Filters - Attack Detected
941300	IE XSS Filters - Attack Detected
941310	US-ASCII Malformed Encoding XSS Filter - Attack Detected
941350	UTF-7 Encoding IE XSS - Attack Detected
941360	JSFuck / Hieroglyphy obfuscation detected
941370	JavaScript global variable found
941390	Javascript method detected
941400	XSS JavaScript function without parentheses
941101	XSS Attack Detected via libinjection
941120	XSS Filter - Category 2: Event Handler Vector
941150	XSS Filter - Category 5: Disallowed HTML Attributes
941181	Node-Validator Deny List Keywords
941320	Possible XSS Attack Detected - HTML Tag Handler
941330	IE XSS Filters - Attack Detected
941340	IE XSS Filters - Attack Detected
941380	AngularJS client side template injection detected

Rule group: 942 - SQL Injection (SQLi)

Comprehensive protection against SQL injection attempts, including blind SQLi and DB-specific payloads.

Code	Rule
942100	SQL Injection Attack Detected via libinjection
942140	SQL Injection Attack: Common DB Names Detected
942151	SQL Injection Attack: SQL function name detected
942160	Detects blind sqli tests using sleep() or benchmark()
942170	Detects SQL benchmark and sleep injection attempts including conditional queries
942190	Detects MSSQL code execution and information gathering attempts
942220	Looking for integer overflow attacks, magic number crash
942230	Detects conditional SQL injection attempts
942240	Detects MySQL charset switch and MSSQL DoS attempts
942250	Detects MATCH AGAINST, MERGE and EXECUTE IMMEDIATE injections
942270	Looking for basic SQL injection. Common attack string for mysql, oracle and others
942280	Detects Postgres pg_sleep injection, waitfor delay attacks
942290	Finds basic MongoDB SQL injection attempts
942320	Detects MySQL and PostgreSQL stored procedure/function injections
942350	Detects MySQL UDF injection and other data/structure manipulation attempts
942360	Detects concatenated basic SQL injection and SQLLFI attempts
942500	MySQL in-line comment detected
942540	SQL Authentication bypass (split query)
942560	MySQL Scientific Notation payload detected
942550	JSON-Based SQL Injection
942120	SQL Injection Attack: SQL Operator Detected
942130	SQL Injection Attack: SQL Boolean-based attack detected
942131	SQL Injection Attack: SQL Boolean-based attack detected
942150	SQL Injection Attack: SQL function name detected
942180	Detects basic SQL authentication bypass attempts 1/3
942200	Detects MySQL comment-/space-obfuscated injections and backtick termination
942210	Detects chained SQL injection attempts 1/2
942260	Detects basic SQL authentication bypass attempts 2/3
942300	Detects MySQL comments, conditions and ch(a)r injections
942310	Detects chained SQL injection attempts 2/2
942330	Detects classic SQL injection probings 1/3
942340	Detects basic SQL authentication bypass attempts 3/3
942361	Detects basic SQL injection based on keyword alter or union
942362	Detects concatenated basic SQL injection and SQLLFI attempts
942370	Detects classic SQL injection probings 2/3
942380	SQL Injection Attack
942390	SQL Injection Attack
942400	SQL Injection Attack
942410	SQL Injection Attack
942470	SQL Injection Attack
942480	SQL Injection Attack
942430	Restricted SQL Character Anomaly Detection (args): # of special characters exceeded (12)
942440	SQL Comment Sequence Detected
942450	SQL Hex Encoding Identified
942510	SQLi bypass attempt by ticks or backticks detected
942520	Detects basic SQL authentication bypass attempts 4.0/4
942521	Detects basic SQL authentication bypass attempts 4.1/4
942522	Detects basic SQL authentication bypass attempts 4.1/4
942101	SQL Injection Attack Detected via libinjection
942152	SQL Injection Attack: SQL function name detected
942321	Detects MySQL and PostgreSQL stored procedure/function injections
942251	Detects HAVING injections
942490	Detects classic SQL injection probings 3/3
942420	Restricted SQL Character Anomaly Detection (cookies): # of special characters exceeded (8)
942431	Restricted SQL Character Anomaly Detection (args): # of special characters exceeded (6)
942460	Meta-Character Anomaly Detection Alert - Repetitive Non-Word Characters
942511	SQLi bypass attempt by ticks detected
942530	SQLi query termination detected
942421	Restricted SQL Character Anomaly Detection (cookies): # of special characters exceeded (3)

Rule group: 943 - Session Fixation

Prevents attackers from hijacking user sessions by forcing a known Session ID.

Code	Rule
943100	Possible Session Fixation Attack: Setting Cookie Values in HTML
943110	Possible Session Fixation Attack: SessionID Parameter Name with Off-Domain Referer
943120	Possible Session Fixation Attack: SessionID Parameter Name with No Referer

Rule group: 944 - Java Injection

Targets Java-specific vulnerabilities, including serialization attacks and Log4shell.

Code	Rule
944100	Remote Command Execution: Suspicious Java class detected
944110	Remote Command Execution: Java process spawn (CVE-2017-9805)
944120	Remote Command Execution: Java serialization (CVE-2015-4852)
944130	Suspicious Java class detected
944140	Java Injection Attack: Java Script File Upload Found
944150	Potential Remote Command Execution: Log4j / Log4shell
944151	Potential Remote Command Execution: Log4j / Log4shell
944200	Magic bytes Detected, probable java serialization in use
944210	Magic bytes Detected Base64 Encoded, probable java serialization in use
944240	Remote Command Execution: Java serialization (CVE-2015-4852)
944250	Remote Command Execution: Suspicious Java method detected
944260	Remote Command Execution: Malicious class-loading payload
944300	Base64 encoded string matched suspicious keyword
944152	Potential Remote Command Execution: Log4j / Log4shell

OWASP CRS response rules

These rules inspect outgoing traffic from your origin to prevent sensitive information from being leaked to users or attackers.

Rule group: 950 - General Data Leakage

Blocks responses containing directory listings, source code, or application error messages.

Code	Rule
950130	Directory Listing
950140	CGI source code leakage
950100	The Application Returned a 500-Level Status Code

Rule group: 951 - Database Information Leakage

Prevents database-specific error messages from revealing your backend architecture.

Code	Rule
951110	Microsoft Access SQL Information Leakage
951120	Oracle SQL Information Leakage
951130	DB2 SQL Information Leakage
951140	EMC SQL Information Leakage
951150	firebird SQL Information Leakage
951160	Frontbase SQL Information Leakage
951170	hsqldb SQL Information Leakage
951180	informix SQL Information Leakage
951190	ingres SQL Information Leakage
951200	interbase SQL Information Leakage
951210	maxDB SQL Information Leakage
951220	mssql SQL Information Leakage
951230	mysql SQL Information Leakage
951240	postgres SQL Information Leakage
951250	sqlite SQL Information Leakage
951260	Sybase SQL Information Leakage

Rule group: 952 - Java Information Leakage

Blocks exposure of Java source code or stack traces.

Code	Rule
952100	Java Source Code Leakage
952110	Java Errors

Rule group: 953 - PHP Information Leakage

Prevents disclosure of PHP source code or internal information.

Code	Rule
953100	PHP Information Leakage
953110	PHP source code leakage
953120	PHP source code leakage
953101	PHP Information Leakage

Rule group: 954 - IIS Information Leakage

Targets information disclosure specific to Microsoft Internet Information Services (IIS).

Code	Rule
954100	Disclosure of IIS install location
954110	Application Availability Error
954120	IIS Information Leakage
954130	IIS Information Leakage

Rule group: 955 - Web Shells

Detects patterns associated with common web shells (backdoors) that provide remote administration.

Code	Rule
955100	Web shell detected
955110	r57 web shell
955120	WSO web shell
955130	b4tm4n web shell
955140	Mini Shell web shell
955150	Ashiyane web shell
955160	Symlink_Sa web shell
955170	CasuS web shell
955180	GRP WebShell
955190	NGHshell web shell
955200	SimAttacker web shell
955210	Unknown web shell
955220	lama’s’hell web shell
955230	lostDC web shell
955240	Unknown web shell
955250	Unknown web shell
955260	Ru24PostWebShell web shell
955270	s72 Shell web shell
955280	PhpSpy web shell
955290	g00nshell web shell
955300	PuNkHoLic shell web shell
955310	azrail web shell
955320	SmEvK_PaThAn Shell web shell
955330	Shell I web shell
955340	b374k m1n1 web shell
955350	webadmin.php file manager