AppSec Generic Test WAF Rule by crowdsecurity | CrowdSec Hub

AppSec Generic Test

WAF rulehttp:testMITRE T1190

By: crowdsecurity
Version: 0.3
Name: crowdsecurity/appsec-generic-test

AppSec Generic Test: trigger on GET /crowdsec-test-NtktlJHV4TfBSK3wvlhiOBnl`

Install with a top-level collection

1 collection include it

sudo cscli collections install ZoeyVid/npmplus

Installs 5 parsers and 54 scenarios, via WAF - Generic Rules.

View NPMplus →

Installation

sudo cscli appsec-rules install crowdsecurity/appsec-generic-test

Then reload CrowdSec: sudo systemctl reload crowdsec

Configuration

Hover a line or a note to see what each field does.

appsec-rules/crowdsecurity/appsec-generic-test.yaml· 25 linesGitHub

1name: crowdsecurity/appsec-generic-test
2description: "AppSec Generic Test: trigger on GET /crowdsec-test-NtktlJHV4TfBSK3wvlhiOBnl`"
3rules:1
4  - and:
5      # 1) Match the HTTP verb
6      - zones:2
7          - METHOD
8        match:3
9          type: regex
10          value: (GET|HEAD)
11      # 2) Match exactly the test path1
12      - zones:2
13          - URI
14        match:3
15          type: equals
16          value: /crowdsec-test-NtktlJHV4TfBSK3wvlhiOBnl
17labels:4
18  service: http
19  type: test
20  confidence: 0
21  spoofable: 3
22  behavior: "http:test"
23  label: "AppSec Generic Test"
24  classification:
25    - attack.T1190

AppSec Generic Test

Installation

Configuration

Installed on

Know where it runs