chore: update
This commit is contained in:
@@ -0,0 +1,246 @@
|
||||
# OWASP Top 10 ModSecurity Rules — Wazuh Active Response
|
||||
|
||||
## Vue d'ensemble
|
||||
|
||||
Ce système détecte et répond aux attaques OWASP Top 10 via ModSecurity + Wazuh.
|
||||
|
||||
**Deux couches de détection :**
|
||||
|
||||
| Type | Trigger | Règle | Level | AR |
|
||||
|------|---------|-------|-------|-----|
|
||||
| **Bloqué (403)** | HTTP 403 | 100220-100281 | 12-15 | Fermer 4h-24h |
|
||||
| **Remontée (Warning)** | Anomaly scoring | 100320-100381 | 6-11 | Fermer 30min-6h |
|
||||
|
||||
---
|
||||
|
||||
## Correspondances CRS ModSecurity
|
||||
|
||||
```
|
||||
941xxx — XSS (Cross-Site Scripting)
|
||||
942xxx — SQL Injection, LDAP Injection, etc.
|
||||
943xxx — XXE (XML External Entity)
|
||||
930xxx — Path Traversal, RFI, RCE, LFI
|
||||
932xxx — Remote Command Execution
|
||||
933xxx — PHP Injection
|
||||
934xxx — Java Injection
|
||||
950xxx — Exploit attempts
|
||||
951xxx — Regex DoS, Scanner detection
|
||||
952xxx — Restricted File Access
|
||||
953xxx — Insecure File Upload
|
||||
954xxx — Proxy abuse, Scanner detection
|
||||
955xxx — HTTP Response Splitting, Header Injection
|
||||
970xxx — SSRF (Server-Side Request Forgery)
|
||||
971xxx — SSRF (alternative patterns)
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## Règles par OWASP Category
|
||||
|
||||
### OWASP #1 : Broken Access Control
|
||||
|
||||
**Détecte :** Path Traversal, File Inclusion, Unauthorized Access
|
||||
|
||||
| Rule ID | Type | Patterns | Level | Description |
|
||||
|---------|------|----------|-------|-------------|
|
||||
| 100250 | Bloqué | 930xx (path\|traversal\|lfi) | 12 | LFI/Path Traversal bloquée |
|
||||
| 100251 | Bloqué | 930xx (rfi\|remote\|include) | 13 | RFI bloquée |
|
||||
| 100252 | Bloqué | 952xx | 11 | File Access bloquée |
|
||||
| 100293 | Bloqué | Freq(100250)×4/180s | 12 | Path Traversal brute-force |
|
||||
| 100350 | Remontée | 930xx (path\|traversal\|lfi) | 8 | LFI attempt (warning) |
|
||||
| 100351 | Remontée | 930xx (rfi\|remote\|include) | 9 | RFI attempt (warning) |
|
||||
| 100352 | Remontée | 952xx | 8 | File Access attempt (warning) |
|
||||
|
||||
**Active Response :**
|
||||
- Bloqué : `firewall-drop 6h`
|
||||
- Brute-force : `firewall-drop 24h`
|
||||
- Remontée : `firewall-drop 2h-4h`
|
||||
|
||||
---
|
||||
|
||||
### OWASP #3 : Injection
|
||||
|
||||
**Détecte :** SQLi, LDAP, Command Injection, PHP/Java Injection
|
||||
|
||||
| Rule ID | Type | Patterns | Level | Description |
|
||||
|---------|------|----------|-------|-------------|
|
||||
| 100220 | Bloqué | 942xx | 13 | SQL Injection bloquée |
|
||||
| 100221 | Bloqué | 942xx (LDAP pattern) | 12 | LDAP Injection bloquée |
|
||||
| 100222 | Bloqué | 932xx | 14 | Command Injection bloquée |
|
||||
| 100223 | Bloqué | 933xx | 13 | PHP Injection bloquée |
|
||||
| 100224 | Bloqué | 934xx | 13 | Java Injection bloquée |
|
||||
| 100290 | Bloqué | Freq(100220)×3/60s | 14 | SQLi brute-force |
|
||||
| 100292 | Bloqué | Freq(100222)×2/60s | 15 | Command Injection CRITICAL |
|
||||
| 100320 | Remontée | 942xx | 9 | SQLi attempt (warning) |
|
||||
| 100321 | Remontée | 932xx | 10 | Command Injection attempt |
|
||||
| 100322 | Remontée | 942xx (LDAP) | 9 | LDAP Injection attempt |
|
||||
| 100323 | Remontée | 933xx\|934xx | 9 | PHP/Java Injection attempt |
|
||||
| 100394 | Remontée | Freq(100320)×5/300s | 10 | SQLi anomaly scoring |
|
||||
| 100396 | Remontée | Freq(100321)×2/60s | 12 | Command Injection CRITICAL |
|
||||
|
||||
**Active Response :**
|
||||
- SQLi Bloquée : `firewall-drop 6h`
|
||||
- SQLi Brute-force : `firewall-drop 24h + host-deny permanent`
|
||||
- Command Injection : `firewall-drop 24h + host-deny`
|
||||
- Command Injection CRITICAL : `firewall-drop permanent + host-deny permanent`
|
||||
- SQLi Remontée : `firewall-drop 2h`
|
||||
- SQLi Anomaly : `firewall-drop 4h`
|
||||
- Command Injection Remontée : `firewall-drop 4h`
|
||||
|
||||
---
|
||||
|
||||
### OWASP #6 : Vulnerable & Outdated Components
|
||||
|
||||
**Détecte :** RCE, Exploit attempts, known vulnerabilities
|
||||
|
||||
| Rule ID | Type | Patterns | Level | Description |
|
||||
|---------|------|----------|-------|-------------|
|
||||
| 100230 | Bloqué | 930xx\|950xx | 14 | RCE/Exploit bloquée |
|
||||
| 100330 | Remontée | 930xx\|950xx | 11 | RCE/Exploit attempt (warning) |
|
||||
|
||||
**Active Response :**
|
||||
- Bloqué : `firewall-drop 24h`
|
||||
- Remontée : `firewall-drop 6h`
|
||||
|
||||
---
|
||||
|
||||
### OWASP #7 : Authentication & Session Management
|
||||
|
||||
**Détecte :** XSS, Header Injection, Session hijacking attempts
|
||||
|
||||
| Rule ID | Type | Patterns | Level | Description |
|
||||
|---------|------|----------|-------|-------------|
|
||||
| 100240 | Bloqué | 941xx | 12 | XSS bloquée |
|
||||
| 100241 | Bloqué | 955xx | 12 | Header Injection bloquée |
|
||||
| 100291 | Bloqué | Freq(100240)×5/120s | 13 | XSS anomaly scoring |
|
||||
| 100340 | Remontée | 941xx | 8 | XSS attempt (warning) |
|
||||
| 100341 | Remontée | 955xx | 8 | Header Injection attempt |
|
||||
| 100395 | Remontée | Freq(100340)×8/300s | 10 | XSS anomaly scoring |
|
||||
|
||||
**Active Response :**
|
||||
- XSS Bloquée : `firewall-drop 4h`
|
||||
- XSS Anomaly : `firewall-drop 6h`
|
||||
- Header Injection : `firewall-drop 6h`
|
||||
- XSS Remontée : `firewall-drop 1h`
|
||||
- Header Remontée : `firewall-drop 2h`
|
||||
|
||||
---
|
||||
|
||||
### OWASP #8 : Software & Data Integrity Failures
|
||||
|
||||
**Détecte :** XXE, Deserialization attacks
|
||||
|
||||
| Rule ID | Type | Patterns | Level | Description |
|
||||
|---------|------|----------|-------|-------------|
|
||||
| 100260 | Bloqué | 943xx | 13 | XXE bloquée |
|
||||
| 100360 | Remontée | 943xx | 9 | XXE attempt (warning) |
|
||||
|
||||
**Active Response :**
|
||||
- Bloqué : `firewall-drop 12h`
|
||||
- Remontée : `firewall-drop 4h`
|
||||
|
||||
---
|
||||
|
||||
### OWASP #9 : Logging & Monitoring Failures
|
||||
|
||||
**Détecte :** Web scanners, bot activity, reconnaissance
|
||||
|
||||
| Rule ID | Type | Patterns | Level | Description |
|
||||
|---------|------|----------|-------|-------------|
|
||||
| 100270 | Bloqué | 951xx\|954xx | 10 | Scanner detection (bloquée) |
|
||||
| 100370 | Remontée | 951xx\|954xx | 6 | Scanner detection (warning) |
|
||||
|
||||
**Active Response :**
|
||||
- Bloqué : `firewall-drop 2h`
|
||||
- Remontée : `firewall-drop 30min`
|
||||
|
||||
---
|
||||
|
||||
### Autres : SSRF & File Upload
|
||||
|
||||
| Rule ID | Type | Patterns | Level | Description |
|
||||
|---------|------|----------|-------|-------------|
|
||||
| 100280 | Bloqué | 970xx\|971xx | 13 | SSRF bloquée |
|
||||
| 100281 | Bloqué | 953xx | 12 | File Upload bloquée |
|
||||
| 100380 | Remontée | 970xx\|971xx | 9 | SSRF attempt |
|
||||
| 100381 | Remontée | 953xx | 8 | File Upload attempt |
|
||||
|
||||
**Active Response :**
|
||||
- SSRF Bloquée : `firewall-drop 12h`
|
||||
- File Upload Bloquée : `firewall-drop 6h`
|
||||
- SSRF Remontée : `firewall-drop 4h`
|
||||
- File Upload Remontée : `firewall-drop 2h`
|
||||
|
||||
---
|
||||
|
||||
## Timeline des Active Responses
|
||||
|
||||
### Bloquées (HTTP 403)
|
||||
|
||||
| Durée | Règles | Motif |
|
||||
|-------|--------|-------|
|
||||
| Permanent | 100292 | Command Injection CRITICAL (2+ tentatives / 60s) |
|
||||
| 24h | 100290 | SQLi brute-force (3+ / 60s) |
|
||||
| 24h | 100230 | RCE/Exploit |
|
||||
| 12h | 100251, 100260, 100280 | RFI, XXE, SSRF |
|
||||
| 6h | 100220, 100221, 100250, 100252, 100281, 100330 | SQLi, LDAP, Path Traversal, File Access, Upload, RCE |
|
||||
| 4h | 100240 | XSS |
|
||||
| 2h | 100270 | Scanner |
|
||||
|
||||
### Remontées (Anomaly Scoring)
|
||||
|
||||
| Durée | Règles | Motif |
|
||||
|-------|--------|-------|
|
||||
| Permanent | 100396 | Command Injection (2+ / 60s) |
|
||||
| 6h | 100395, 100330, 100351 | XSS anomaly, RCE, RFI |
|
||||
| 4h | 100394, 100321, 100323, 100360, 100380 | SQLi anomaly, Cmd Inj, PHP/Java, XXE, SSRF |
|
||||
| 2h | 100320, 100322, 100341, 100350, 100352, 100381 | SQLi, LDAP, Header Inj, Path Traversal, File Access, Upload |
|
||||
| 30min | 100370 | Scanner |
|
||||
|
||||
---
|
||||
|
||||
## Files
|
||||
|
||||
- **`modsecurity_owasp_rules.xml`** — Définition des règles (100220-100396)
|
||||
- **`ossec.conf`** — Active-response configs (firewall-drop, durées)
|
||||
- **`firewall-monitoring-uber.sh`** — iptables pour autoriser trafic ModSec
|
||||
|
||||
---
|
||||
|
||||
## Monitoring
|
||||
|
||||
**Dashboard Wazuh :**
|
||||
|
||||
1. **Alerts → Security Events → OWASP**
|
||||
2. **Visualization:**
|
||||
- Blocking rate (HTTP 403)
|
||||
- Anomaly scoring trends
|
||||
- Top attackers (srcip)
|
||||
- Attack distribution by category
|
||||
|
||||
**Logs:**
|
||||
|
||||
```bash
|
||||
# On monitoring-uber
|
||||
tail -f /var/ossec/logs/alerts/alerts.json | grep -i "owasp\|100[23][0-9][0-9]"
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## Tuning
|
||||
|
||||
Les seuils de fréquence peuvent être ajustés :
|
||||
|
||||
- **SQLi anomaly:** `frequency="5" timeframe="300"` → Réduire pour être plus agressif
|
||||
- **XSS anomaly:** `frequency="8" timeframe="300"` → Augmenter pour réduire false positives
|
||||
- **Command Injection:** `frequency="2" timeframe="60"` → Critique, ne pas modifier
|
||||
|
||||
---
|
||||
|
||||
## Notes
|
||||
|
||||
- **First-match semantics:** Wazuh évalue les règles par ID croissant → les règles bloquées (100220+) ont priorité sur les remontées (100320+)
|
||||
- **Field matching:** Les patterns utilisent `<field name="transaction.messages.message">` pour matcher les CRS rule IDs dans les logs ModSecurity
|
||||
- **SCA suppressed:** Les alertes SCA (CIS benchmark) sont à level 0 (voir `local_sca_noise.xml`)
|
||||
- **Persistence:** Tous les AR sont sauvegardés dans `iptables-save` → survient les reboots
|
||||
|
||||
Reference in New Issue
Block a user