Skip to content

App Gateway - OWASP 3.2

Generated: 22 February 2026 | Total Rules: 185

OWASP 3.2

General -

Rule ID Rule Group Description Action State CRS Source
200002 General Failed to Parse Request Body. AnomalyScoring Enabled
200003 General Multipart Request Body Strict Validation. AnomalyScoring Enabled
200004 General Possible Multipart Unmatched Boundary. AnomalyScoring Enabled

REQUEST-911-METHOD-ENFORCEMENT -

Rule ID Rule Group Description Action State CRS Source
911100 REQUEST-911-METHOD-ENFORCEMENT Method is not allowed by policy AnomalyScoring Enabled source

REQUEST-913-SCANNER-DETECTION -

Rule ID Rule Group Description Action State CRS Source
913100 REQUEST-913-SCANNER-DETECTION Found User-Agent associated with security scanner AnomalyScoring Enabled source
913101 REQUEST-913-SCANNER-DETECTION Found User-Agent associated with scripting/generic HTTP client AnomalyScoring Enabled source
913102 REQUEST-913-SCANNER-DETECTION Found User-Agent associated with web crawler/bot AnomalyScoring Enabled source
913110 REQUEST-913-SCANNER-DETECTION Found request header associated with security scanner AnomalyScoring Enabled source
913120 REQUEST-913-SCANNER-DETECTION Found request filename/argument associated with security scanner AnomalyScoring Enabled source

REQUEST-920-PROTOCOL-ENFORCEMENT -

Rule ID Rule Group Description Action State CRS Source
920100 REQUEST-920-PROTOCOL-ENFORCEMENT Invalid HTTP Request Line AnomalyScoring Enabled source
920120 REQUEST-920-PROTOCOL-ENFORCEMENT Attempted multipart/form-data bypass AnomalyScoring Enabled source
920121 REQUEST-920-PROTOCOL-ENFORCEMENT Attempted multipart/form-data bypass AnomalyScoring Enabled source
920160 REQUEST-920-PROTOCOL-ENFORCEMENT Content-Length HTTP header is not numeric. AnomalyScoring Enabled source
920170 REQUEST-920-PROTOCOL-ENFORCEMENT GET or HEAD Request with Body Content. AnomalyScoring Enabled source
920171 REQUEST-920-PROTOCOL-ENFORCEMENT GET or HEAD Request with Transfer-Encoding. AnomalyScoring Enabled source
920180 REQUEST-920-PROTOCOL-ENFORCEMENT POST request missing Content-Length Header. AnomalyScoring Enabled source
920190 REQUEST-920-PROTOCOL-ENFORCEMENT Range: Invalid Last Byte Value. AnomalyScoring Enabled source
920200 REQUEST-920-PROTOCOL-ENFORCEMENT Range: Too many fields (6 or more) AnomalyScoring Enabled source
920201 REQUEST-920-PROTOCOL-ENFORCEMENT Range: Too many fields for pdf request (35 or more) AnomalyScoring Enabled source
920202 REQUEST-920-PROTOCOL-ENFORCEMENT Range: Too many fields for pdf request (6 or more) AnomalyScoring Enabled source
920210 REQUEST-920-PROTOCOL-ENFORCEMENT Multiple/Conflicting Connection Header Data Found. AnomalyScoring Enabled source
920220 REQUEST-920-PROTOCOL-ENFORCEMENT URL Encoding Abuse Attack Attempt AnomalyScoring Enabled source
920230 REQUEST-920-PROTOCOL-ENFORCEMENT Multiple URL Encoding Detected AnomalyScoring Enabled source
920240 REQUEST-920-PROTOCOL-ENFORCEMENT URL Encoding Abuse Attack Attempt AnomalyScoring Enabled source
920250 REQUEST-920-PROTOCOL-ENFORCEMENT UTF8 Encoding Abuse Attack Attempt AnomalyScoring Enabled source
920260 REQUEST-920-PROTOCOL-ENFORCEMENT Unicode Full/Half Width Abuse Attack Attempt AnomalyScoring Enabled source
920270 REQUEST-920-PROTOCOL-ENFORCEMENT Invalid character in request (null character) AnomalyScoring Enabled source
920271 REQUEST-920-PROTOCOL-ENFORCEMENT Invalid character in request (non printable characters) AnomalyScoring Enabled source
920272 REQUEST-920-PROTOCOL-ENFORCEMENT Invalid character in request (outside of printable chars below ascii 127) AnomalyScoring Enabled source
920273 REQUEST-920-PROTOCOL-ENFORCEMENT Invalid character in request (outside of very strict set) AnomalyScoring Enabled source
920274 REQUEST-920-PROTOCOL-ENFORCEMENT Invalid character in request headers (outside of very strict set) AnomalyScoring Enabled source
920280 REQUEST-920-PROTOCOL-ENFORCEMENT Request Missing a Host Header AnomalyScoring Enabled source
920290 REQUEST-920-PROTOCOL-ENFORCEMENT Empty Host Header AnomalyScoring Enabled source
920300 REQUEST-920-PROTOCOL-ENFORCEMENT Request Missing an Accept Header AnomalyScoring Enabled source
920310 REQUEST-920-PROTOCOL-ENFORCEMENT Request Has an Empty Accept Header AnomalyScoring Enabled source
920311 REQUEST-920-PROTOCOL-ENFORCEMENT Request Has an Empty Accept Header AnomalyScoring Enabled source
920320 REQUEST-920-PROTOCOL-ENFORCEMENT Missing User Agent Header AnomalyScoring Enabled source
920330 REQUEST-920-PROTOCOL-ENFORCEMENT Empty User Agent Header AnomalyScoring Enabled source
920340 REQUEST-920-PROTOCOL-ENFORCEMENT Request Containing Content, but Missing Content-Type header AnomalyScoring Enabled source
920341 REQUEST-920-PROTOCOL-ENFORCEMENT Request containing content requires Content-Type header AnomalyScoring Enabled source
920350 REQUEST-920-PROTOCOL-ENFORCEMENT Host header is a numeric IP address AnomalyScoring Enabled source
920420 REQUEST-920-PROTOCOL-ENFORCEMENT Request content type is not allowed by policy AnomalyScoring Enabled source
920430 REQUEST-920-PROTOCOL-ENFORCEMENT HTTP protocol version is not allowed by policy AnomalyScoring Enabled source
920440 REQUEST-920-PROTOCOL-ENFORCEMENT URL file extension is restricted by policy AnomalyScoring Enabled source
920450 REQUEST-920-PROTOCOL-ENFORCEMENT HTTP header is restricted by policy (%{MATCHED_VAR}) AnomalyScoring Enabled source
920460 REQUEST-920-PROTOCOL-ENFORCEMENT Abnormal Escape Characters AnomalyScoring Enabled source
920470 REQUEST-920-PROTOCOL-ENFORCEMENT Illegal Content-Type header AnomalyScoring Enabled source
920480 REQUEST-920-PROTOCOL-ENFORCEMENT Restrict charset parameter within the content-type header AnomalyScoring Enabled source

REQUEST-921-PROTOCOL-ATTACK -

Rule ID Rule Group Description Action State CRS Source
921110 REQUEST-921-PROTOCOL-ATTACK HTTP Request Smuggling Attack AnomalyScoring Enabled source
921120 REQUEST-921-PROTOCOL-ATTACK HTTP Response Splitting Attack AnomalyScoring Enabled source
921130 REQUEST-921-PROTOCOL-ATTACK HTTP Response Splitting Attack AnomalyScoring Enabled source
921140 REQUEST-921-PROTOCOL-ATTACK HTTP Header Injection Attack via headers AnomalyScoring Enabled source
921150 REQUEST-921-PROTOCOL-ATTACK HTTP Header Injection Attack via payload (CR/LF detected) AnomalyScoring Enabled source
921151 REQUEST-921-PROTOCOL-ATTACK HTTP Header Injection Attack via payload (CR/LF detected) AnomalyScoring Enabled source
921160 REQUEST-921-PROTOCOL-ATTACK HTTP Header Injection Attack via payload (CR/LF and header-name detected) AnomalyScoring Enabled source
921170 REQUEST-921-PROTOCOL-ATTACK HTTP Parameter Pollution AnomalyScoring Enabled source
921180 REQUEST-921-PROTOCOL-ATTACK HTTP Parameter Pollution (%{TX.1}) AnomalyScoring Enabled source

REQUEST-930-APPLICATION-ATTACK-LFI -

Rule ID Rule Group Description Action State CRS Source
930100 REQUEST-930-APPLICATION-ATTACK-LFI Path Traversal Attack (/../) AnomalyScoring Enabled source
930110 REQUEST-930-APPLICATION-ATTACK-LFI Path Traversal Attack (/../) AnomalyScoring Enabled source
930120 REQUEST-930-APPLICATION-ATTACK-LFI OS File Access Attempt AnomalyScoring Enabled source
930130 REQUEST-930-APPLICATION-ATTACK-LFI Restricted File Access Attempt AnomalyScoring Enabled source

REQUEST-931-APPLICATION-ATTACK-RFI -

Rule ID Rule Group Description Action State CRS Source
931100 REQUEST-931-APPLICATION-ATTACK-RFI Possible Remote File Inclusion (RFI) Attack: URL Parameter using IP Address AnomalyScoring Enabled source
931110 REQUEST-931-APPLICATION-ATTACK-RFI Possible Remote File Inclusion (RFI) Attack: Common RFI Vulnerable Parameter Name used w/URL Payload AnomalyScoring Enabled source
931120 REQUEST-931-APPLICATION-ATTACK-RFI Possible Remote File Inclusion (RFI) Attack: URL Payload Used w/Trailing Question Mark Character (?) AnomalyScoring Enabled source
931130 REQUEST-931-APPLICATION-ATTACK-RFI Possible Remote File Inclusion (RFI) Attack: Off-Domain Reference/Link AnomalyScoring Enabled source

REQUEST-932-APPLICATION-ATTACK-RCE -

Rule ID Rule Group Description Action State CRS Source
932100 REQUEST-932-APPLICATION-ATTACK-RCE Remote Command Execution: Unix Command Injection AnomalyScoring Enabled source
932105 REQUEST-932-APPLICATION-ATTACK-RCE Remote Command Execution: Unix Command Injection AnomalyScoring Enabled source
932106 REQUEST-932-APPLICATION-ATTACK-RCE Remote Command Execution: Unix Command Injection AnomalyScoring Enabled source
932110 REQUEST-932-APPLICATION-ATTACK-RCE Remote Command Execution: Windows Command Injection AnomalyScoring Enabled source
932115 REQUEST-932-APPLICATION-ATTACK-RCE Remote Command Execution: Windows Command Injection AnomalyScoring Enabled source
932120 REQUEST-932-APPLICATION-ATTACK-RCE Remote Command Execution: Windows PowerShell Command Found AnomalyScoring Enabled source
932130 REQUEST-932-APPLICATION-ATTACK-RCE Remote Command Execution: Unix Shell Expression or Confluence Vulnerability (CVE-2022-26134) Found AnomalyScoring Enabled source
932140 REQUEST-932-APPLICATION-ATTACK-RCE Remote Command Execution: Windows FOR/IF Command Found AnomalyScoring Enabled source
932150 REQUEST-932-APPLICATION-ATTACK-RCE Remote Command Execution: Direct Unix Command Execution AnomalyScoring Enabled source
932160 REQUEST-932-APPLICATION-ATTACK-RCE Remote Command Execution: Unix Shell Code Found AnomalyScoring Enabled source
932170 REQUEST-932-APPLICATION-ATTACK-RCE Remote Command Execution: Shellshock (CVE-2014-6271) AnomalyScoring Enabled source
932171 REQUEST-932-APPLICATION-ATTACK-RCE Remote Command Execution: Shellshock (CVE-2014-6271) AnomalyScoring Enabled source
932180 REQUEST-932-APPLICATION-ATTACK-RCE Restricted File Upload Attempt AnomalyScoring Enabled source
932190 REQUEST-932-APPLICATION-ATTACK-RCE Remote Command Execution: Wildcard bypass technique attempt AnomalyScoring Enabled source

REQUEST-933-APPLICATION-ATTACK-PHP -

Rule ID Rule Group Description Action State CRS Source
933100 REQUEST-933-APPLICATION-ATTACK-PHP PHP Injection Attack: Opening/Closing Tag Found AnomalyScoring Enabled source
933110 REQUEST-933-APPLICATION-ATTACK-PHP PHP Injection Attack: PHP Script File Upload Found AnomalyScoring Enabled source
933111 REQUEST-933-APPLICATION-ATTACK-PHP PHP Injection Attack: PHP Script File Upload Found AnomalyScoring Enabled source
933120 REQUEST-933-APPLICATION-ATTACK-PHP PHP Injection Attack: Configuration Directive Found AnomalyScoring Enabled source
933130 REQUEST-933-APPLICATION-ATTACK-PHP PHP Injection Attack: Variables Found AnomalyScoring Enabled source
933131 REQUEST-933-APPLICATION-ATTACK-PHP PHP Injection Attack: Variables Found AnomalyScoring Enabled source
933140 REQUEST-933-APPLICATION-ATTACK-PHP PHP Injection Attack: I/O Stream Found AnomalyScoring Enabled source
933150 REQUEST-933-APPLICATION-ATTACK-PHP PHP Injection Attack: High-Risk PHP Function Name Found AnomalyScoring Enabled source
933151 REQUEST-933-APPLICATION-ATTACK-PHP PHP Injection Attack: Medium-Risk PHP Function Name Found AnomalyScoring Enabled source
933160 REQUEST-933-APPLICATION-ATTACK-PHP PHP Injection Attack: High-Risk PHP Function Call Found AnomalyScoring Enabled source
933161 REQUEST-933-APPLICATION-ATTACK-PHP PHP Injection Attack: Low-Value PHP Function Call Found AnomalyScoring Enabled source
933170 REQUEST-933-APPLICATION-ATTACK-PHP PHP Injection Attack: Serialized Object Injection AnomalyScoring Enabled source
933180 REQUEST-933-APPLICATION-ATTACK-PHP PHP Injection Attack: Variable Function Call Found AnomalyScoring Enabled source
933190 REQUEST-933-APPLICATION-ATTACK-PHP PHP Injection Attack: PHP Closing Tag Found AnomalyScoring Enabled source
933200 REQUEST-933-APPLICATION-ATTACK-PHP PHP Injection Attack: Wrapper scheme detected AnomalyScoring Enabled source
933210 REQUEST-933-APPLICATION-ATTACK-PHP PHP Injection Attack: Variable Function Call Found AnomalyScoring Enabled source

REQUEST-941-APPLICATION-ATTACK-XSS -

Rule ID Rule Group Description Action State CRS Source
941100 REQUEST-941-APPLICATION-ATTACK-XSS XSS Attack Detected via libinjection AnomalyScoring Enabled source
941101 REQUEST-941-APPLICATION-ATTACK-XSS XSS Attack Detected via libinjection. AnomalyScoring Enabled source
941110 REQUEST-941-APPLICATION-ATTACK-XSS XSS Filter - Category 1: Script Tag Vector AnomalyScoring Enabled source
941120 REQUEST-941-APPLICATION-ATTACK-XSS XSS Filter - Category 2: Event Handler Vector AnomalyScoring Enabled source
941130 REQUEST-941-APPLICATION-ATTACK-XSS XSS Filter - Category 3: Attribute Vector AnomalyScoring Enabled source
941140 REQUEST-941-APPLICATION-ATTACK-XSS XSS Filter - Category 4: Javascript URI Vector AnomalyScoring Enabled source
941150 REQUEST-941-APPLICATION-ATTACK-XSS XSS Filter - Category 5: Disallowed HTML Attributes AnomalyScoring Enabled source
941160 REQUEST-941-APPLICATION-ATTACK-XSS NoScript XSS InjectionChecker: HTML Injection AnomalyScoring Enabled source
941170 REQUEST-941-APPLICATION-ATTACK-XSS NoScript XSS InjectionChecker: Attribute Injection AnomalyScoring Enabled source
941180 REQUEST-941-APPLICATION-ATTACK-XSS Node-Validator Blacklist Keywords AnomalyScoring Enabled source
941190 REQUEST-941-APPLICATION-ATTACK-XSS XSS Using style sheets AnomalyScoring Enabled source
941200 REQUEST-941-APPLICATION-ATTACK-XSS XSS using VML frames AnomalyScoring Enabled source
941210 REQUEST-941-APPLICATION-ATTACK-XSS XSS using obfuscated JavaScript AnomalyScoring Enabled source
941220 REQUEST-941-APPLICATION-ATTACK-XSS XSS using obfuscated VB Script AnomalyScoring Enabled source
941230 REQUEST-941-APPLICATION-ATTACK-XSS XSS using 'embed' tag AnomalyScoring Enabled source
941240 REQUEST-941-APPLICATION-ATTACK-XSS XSS using 'import' or 'implementation' attribute AnomalyScoring Enabled source
941250 REQUEST-941-APPLICATION-ATTACK-XSS IE XSS Filters - Attack Detected. AnomalyScoring Enabled source
941260 REQUEST-941-APPLICATION-ATTACK-XSS XSS using 'meta' tag AnomalyScoring Enabled source
941270 REQUEST-941-APPLICATION-ATTACK-XSS XSS using 'link' href AnomalyScoring Enabled source
941280 REQUEST-941-APPLICATION-ATTACK-XSS XSS using 'base' tag AnomalyScoring Enabled source
941290 REQUEST-941-APPLICATION-ATTACK-XSS XSS using 'applet' tag AnomalyScoring Enabled source
941300 REQUEST-941-APPLICATION-ATTACK-XSS XSS using 'object' tag AnomalyScoring Enabled source
941310 REQUEST-941-APPLICATION-ATTACK-XSS US-ASCII Malformed Encoding XSS Filter - Attack Detected. AnomalyScoring Enabled source
941320 REQUEST-941-APPLICATION-ATTACK-XSS Possible XSS Attack Detected - HTML Tag Handler AnomalyScoring Enabled source
941330 REQUEST-941-APPLICATION-ATTACK-XSS IE XSS Filters - Attack Detected. AnomalyScoring Enabled source
941340 REQUEST-941-APPLICATION-ATTACK-XSS IE XSS Filters - Attack Detected. AnomalyScoring Enabled source
941350 REQUEST-941-APPLICATION-ATTACK-XSS UTF-7 Encoding IE XSS - Attack Detected. AnomalyScoring Enabled source
941360 REQUEST-941-APPLICATION-ATTACK-XSS JavaScript obfuscation detected. AnomalyScoring Enabled source

REQUEST-942-APPLICATION-ATTACK-SQLI -

Rule ID Rule Group Description Action State CRS Source
942100 REQUEST-942-APPLICATION-ATTACK-SQLI SQL Injection Attack Detected via libinjection AnomalyScoring Enabled source
942110 REQUEST-942-APPLICATION-ATTACK-SQLI SQL Injection Attack: Common Injection Testing Detected AnomalyScoring Enabled source
942120 REQUEST-942-APPLICATION-ATTACK-SQLI SQL Injection Attack: SQL Operator Detected AnomalyScoring Enabled source
942130 REQUEST-942-APPLICATION-ATTACK-SQLI SQL Injection Attack: SQL Tautology Detected. AnomalyScoring Enabled source
942140 REQUEST-942-APPLICATION-ATTACK-SQLI SQL Injection Attack: Common DB Names Detected AnomalyScoring Enabled source
942150 REQUEST-942-APPLICATION-ATTACK-SQLI SQL Injection Attack AnomalyScoring Enabled source
942160 REQUEST-942-APPLICATION-ATTACK-SQLI Detects blind sqli tests using sleep() or benchmark(). AnomalyScoring Enabled source
942170 REQUEST-942-APPLICATION-ATTACK-SQLI Detects SQL benchmark and sleep injection attempts including conditional queries AnomalyScoring Enabled source
942180 REQUEST-942-APPLICATION-ATTACK-SQLI Detects basic SQL authentication bypass attempts ⅓ AnomalyScoring Enabled source
942190 REQUEST-942-APPLICATION-ATTACK-SQLI Detects MSSQL code execution and information gathering attempts AnomalyScoring Enabled source
942200 REQUEST-942-APPLICATION-ATTACK-SQLI Detects MySQL comment-/space-obfuscated injections and backtick termination AnomalyScoring Enabled source
942210 REQUEST-942-APPLICATION-ATTACK-SQLI Detects chained SQL injection attempts ½ AnomalyScoring Enabled source
942220 REQUEST-942-APPLICATION-ATTACK-SQLI Looking for intiger overflow attacks, these are taken from skipfish, except 3.0.00738585072007e-308 is the \"magic number\" crash AnomalyScoring Enabled source
942230 REQUEST-942-APPLICATION-ATTACK-SQLI Detects conditional SQL injection attempts AnomalyScoring Enabled source
942240 REQUEST-942-APPLICATION-ATTACK-SQLI Detects MySQL charset switch and MSSQL DoS attempts AnomalyScoring Enabled source
942250 REQUEST-942-APPLICATION-ATTACK-SQLI Detects MATCH AGAINST, MERGE and EXECUTE IMMEDIATE injections AnomalyScoring Enabled source
942251 REQUEST-942-APPLICATION-ATTACK-SQLI Detects HAVING injections AnomalyScoring Enabled source
942260 REQUEST-942-APPLICATION-ATTACK-SQLI Detects basic SQL authentication bypass attempts ⅔ AnomalyScoring Enabled source
942270 REQUEST-942-APPLICATION-ATTACK-SQLI Looking for basic sql injection. Common attack string for mysql, oracle and others. AnomalyScoring Enabled source
942280 REQUEST-942-APPLICATION-ATTACK-SQLI Detects Postgres pg_sleep injection, waitfor delay attacks and database shutdown attempts AnomalyScoring Enabled source
942290 REQUEST-942-APPLICATION-ATTACK-SQLI Finds basic MongoDB SQL injection attempts AnomalyScoring Enabled source
942300 REQUEST-942-APPLICATION-ATTACK-SQLI Detects MySQL comments, conditions and ch(a)r injections AnomalyScoring Enabled source
942310 REQUEST-942-APPLICATION-ATTACK-SQLI Detects chained SQL injection attempts 2/2 AnomalyScoring Enabled source
942320 REQUEST-942-APPLICATION-ATTACK-SQLI Detects MySQL and PostgreSQL stored procedure/function injections AnomalyScoring Enabled source
942330 REQUEST-942-APPLICATION-ATTACK-SQLI Detects classic SQL injection probings ½ AnomalyScoring Enabled source
942340 REQUEST-942-APPLICATION-ATTACK-SQLI Detects basic SQL authentication bypass attempts 3/3 AnomalyScoring Enabled source
942350 REQUEST-942-APPLICATION-ATTACK-SQLI Detects MySQL UDF injection and other data/structure manipulation attempts AnomalyScoring Enabled source
942360 REQUEST-942-APPLICATION-ATTACK-SQLI Detects concatenated basic SQL injection and SQLLFI attempts AnomalyScoring Enabled source
942361 REQUEST-942-APPLICATION-ATTACK-SQLI Detects basic SQL injection based on keyword alter or union AnomalyScoring Enabled source
942370 REQUEST-942-APPLICATION-ATTACK-SQLI Detects classic SQL injection probings 2/2 AnomalyScoring Enabled source
942380 REQUEST-942-APPLICATION-ATTACK-SQLI SQL Injection Attack AnomalyScoring Enabled source
942390 REQUEST-942-APPLICATION-ATTACK-SQLI SQL Injection Attack AnomalyScoring Enabled source
942400 REQUEST-942-APPLICATION-ATTACK-SQLI SQL Injection Attack AnomalyScoring Enabled source
942410 REQUEST-942-APPLICATION-ATTACK-SQLI SQL Injection Attack AnomalyScoring Enabled source
942420 REQUEST-942-APPLICATION-ATTACK-SQLI Restricted SQL Character Anomaly Detection (cookies): # of special characters exceeded (8) AnomalyScoring Enabled source
942421 REQUEST-942-APPLICATION-ATTACK-SQLI Restricted SQL Character Anomaly Detection (cookies): # of special characters exceeded (3) AnomalyScoring Enabled source
942430 REQUEST-942-APPLICATION-ATTACK-SQLI Restricted SQL Character Anomaly Detection (args): # of special characters exceeded (12) AnomalyScoring Enabled source
942431 REQUEST-942-APPLICATION-ATTACK-SQLI Restricted SQL Character Anomaly Detection (args): # of special characters exceeded (6) AnomalyScoring Enabled source
942432 REQUEST-942-APPLICATION-ATTACK-SQLI Restricted SQL Character Anomaly Detection (args): # of special characters exceeded (2) AnomalyScoring Enabled source
942440 REQUEST-942-APPLICATION-ATTACK-SQLI SQL Comment Sequence Detected. AnomalyScoring Enabled source
942450 REQUEST-942-APPLICATION-ATTACK-SQLI SQL Hex Encoding Identified AnomalyScoring Enabled source
942460 REQUEST-942-APPLICATION-ATTACK-SQLI Meta-Character Anomaly Detection Alert - Repetitive Non-Word Characters AnomalyScoring Enabled source
942470 REQUEST-942-APPLICATION-ATTACK-SQLI SQL Injection Attack AnomalyScoring Enabled source
942480 REQUEST-942-APPLICATION-ATTACK-SQLI SQL Injection Attack AnomalyScoring Enabled source
942490 REQUEST-942-APPLICATION-ATTACK-SQLI Detects classic SQL injection probings 3/3 AnomalyScoring Enabled source
942500 REQUEST-942-APPLICATION-ATTACK-SQLI MySQL in-line comment detected. AnomalyScoring Enabled source

REQUEST-943-APPLICATION-ATTACK-SESSION-FIXATION -

Rule ID Rule Group Description Action State CRS Source
943100 REQUEST-943-APPLICATION-ATTACK-SESSION-FIXATION Possible Session Fixation Attack: Setting Cookie Values in HTML AnomalyScoring Enabled source
943110 REQUEST-943-APPLICATION-ATTACK-SESSION-FIXATION Possible Session Fixation Attack: SessionID Parameter Name with Off-Domain Referer AnomalyScoring Enabled source
943120 REQUEST-943-APPLICATION-ATTACK-SESSION-FIXATION Possible Session Fixation Attack: SessionID Parameter Name with No Referer AnomalyScoring Enabled source

REQUEST-944-APPLICATION-ATTACK-JAVA -

Rule ID Rule Group Description Action State CRS Source
944100 REQUEST-944-APPLICATION-ATTACK-JAVA Remote Command Execution: Apache Struts, Oracle WebLogic AnomalyScoring Enabled source
944110 REQUEST-944-APPLICATION-ATTACK-JAVA Detects potential payload execution AnomalyScoring Enabled source
944120 REQUEST-944-APPLICATION-ATTACK-JAVA Possible payload execution and remote command execution AnomalyScoring Enabled source
944130 REQUEST-944-APPLICATION-ATTACK-JAVA Suspicious Java classes AnomalyScoring Enabled source
944200 REQUEST-944-APPLICATION-ATTACK-JAVA Exploitation of Java deserialization Apache Commons AnomalyScoring Enabled source
944210 REQUEST-944-APPLICATION-ATTACK-JAVA Possible use of Java serialization AnomalyScoring Enabled source
944240 REQUEST-944-APPLICATION-ATTACK-JAVA Remote Command Execution: Java serialization AnomalyScoring Enabled source
944250 REQUEST-944-APPLICATION-ATTACK-JAVA Remote Command Execution: Suspicious Java method detected AnomalyScoring Enabled source

Known-CVEs - This Rule Group contains Rules for new and known CVEs

Rule ID Rule Group Description Action State CRS Source
800100 Known-CVEs Rule to help detect and mitigate log4j vulnerability - CVE-2021-44228, CVE-2021-45046 AnomalyScoring Enabled
800110 Known-CVEs Spring4Shell Interaction Attempt AnomalyScoring Enabled
800111 Known-CVEs Attempted Spring Cloud routing-expression injection - CVE-2022-22963 AnomalyScoring Enabled
800112 Known-CVEs Attempted Spring Framework unsafe class object exploitation - CVE-2022-22965 AnomalyScoring Enabled
800113 Known-CVEs Attempted Spring Cloud Gateway Actuator injection - CVE-2022-22947 AnomalyScoring Enabled