WordPress Uploads - PHP Execution WAF Rule by crowdsecurity | CrowdSec Hub

WordPress Uploads - PHP Execution

WAF rulehttp:exploitMITRE T1595MITRE T1190

By: crowdsecurity
Version: 0.3
Name: crowdsecurity/generic-wordpress-uploads-php

Detect php execution in wordpress uploads directory

Install with a top-level collection

1 collection include it

sudo cscli collections install ZoeyVid/npmplus

Installs 5 parsers and 54 scenarios, via WAF - Generic Rules.

View NPMplus →

Installation

sudo cscli appsec-rules install crowdsecurity/generic-wordpress-uploads-php

Then reload CrowdSec: sudo systemctl reload crowdsec

Configuration

Hover a line or a note to see what each field does.

appsec-rules/crowdsecurity/generic-wordpress-uploads-php.yaml· 23 linesGitHub

1name: crowdsecurity/generic-wordpress-uploads-php
2description: "Detect php execution in wordpress uploads directory"
3rules:1
4  - and:
5    - zones: 2
6      - URI
7      transform:3
8      - urldecode
9      - lowercase
10      match:4
11        type: regex
12        value: '/wp-content/uploads/.*\.(h?ph(p|tm?l?|ar)|module|shtml)'
13
14labels:5
15   type: exploit
16   service: http
17   confidence: 2
18   spoofable: 0
19   behavior: "http:exploit"
20   label: "WordPress Uploads - PHP Execution"
21   classification:
22     - attack.T1595
23     - attack.T1190

WordPress Uploads - PHP Execution

Installation

Configuration

Installed on

Know where it runs