1name: crowdsecurity/generic-wordpress-uploads-listing
2description: "Protect Wordpress uploads directory from listing files"
3rules:
4  - or:
5    - zones: 
6      - URI
7      transform:
8      - lowercase
9      - urldecode
10      match:
11        type: regex
12        value: '^/wp-content/uploads/$'
13    - zones: 
14      - URI
15      transform:
16      - lowercase
17      - urldecode
18      match:
19        type: regex
20        value: '^/wp-content/uploads/.*/$'
21    
22labels:
23   type: exploit
24   service: http
25   confidence: 2
26   spoofable: 0
27   behavior: "http:exploit"
28   label: "Protect Wordpress uploads directory from listing files"
29   classification:
30     - attack.T1595
31     - attack.T1190
32