1# naxsi vpatch rules detection
2type: trigger
3name: crowdsecurity/naxsi-exploit-vpatch
4# id is bigger than 9k, custom rule
5description: "Detect custom blacklist triggered in naxsi"
6filter: "evt.Meta.log_type == 'waf_naxsi-log' && len(evt.Parsed.naxsi_id) > 4"
7groupby: "evt.Meta.source_ip"
8blackhole: 5m
9labels:
10  remediation: true
11  confidence: 2
12  spoofable: 0
13  classification:
14    - attack.T1595
15    - attack.T1190
16  behavior: "http:exploit"
17  service: http
18