rules
coreruleset
Our great sponsors
rules | coreruleset | |
---|---|---|
7 | 13 | |
3,970 | 1,957 | |
1.7% | 4.3% | |
0.0 | 9.7 | |
10 days ago | 3 days ago | |
YARA | Python | |
GNU General Public License v3.0 only | Apache License 2.0 |
Stars - the number of stars that a project has on GitHub. Growth - month over month growth in stars.
Activity is a relative number indicating how actively a project is being developed. Recent commits have higher weight than older ones.
For example, an activity of 9.0 indicates that a project is amongst the top 10% of the most actively developed projects that we are tracking.
rules
-
Web Security Resources Request
Yara rules. https://github.com/Yara-Rules/rules
-
How to check is a linux server is compromised or rooted?
On the other hand, you could also use a Yara scanner (apt install yara) to scan for IOCs. Here's a good list of rules https://github.com/Yara-Rules/rules
-
What is the use of an Av when it can be bypassed easily?
As we can see in this pic -> https://i.postimg.cc/qRPSyjvL/Screenshot-at-2022-09-04-13-36-40.png the crypted payload also fires off a lot more of the yara rules from the Yara Rules Project, so it's just a lot "louder" in terms of static analysis too. Top section is a payload that currently does not get detected, and does not use any encryption (the other screenshot showing OneNote.exe was actually taken from my test VM with this payload, so it definitely doesn't get detected lol). Bottom is the scarecrow payload that's aes256'd and still got caught pretty quick.
- Incorporating YARA Into Security Processes?
- Python Script EXE detected as virus in VT
-
YARA Rules for Malware
this repo is well-maintained. there are others exchanged in less public settings (in which i do not participate) if you're willing to contribute samples and signatures.
- Incident report collection
coreruleset
-
Hardening Apache APISIX with the OWASP's Coraza and Core Ruleset
--OWASP® ModSecurity Core Rule Set website
-
Looking for feedback on a security-related project idea
The other thing that came to my mind is the OWASP ModSecurity Core Rule Set (https://coreruleset.org/), which seems somewhat analogous to your proposal. If so, it might be worth chatting with some of the CRS maintainers about what their journey was.
- Access Denied
-
Modsecurity Wordpress exceptions
I would say it depends on your version. The core rule set git repo shows REQUEST-903.9002-WORDPRESS-EXCLUSION-RULES.conf being in versions 3.0.2 through 3.3.4.
-
Web Security Resources Request
If your focus is on generic detection rules than a good resource to start with is the OWASP ModSecurity Core Rule Set (CRS) - However, this rule set is built for the mod_security WAF but depending on what data you get in from your customers, you might be able to forward it against your own mod_security instance and process the mod_security audit logs in Splunk without having to re-write/convert the rules.
-
ModSecurity headers.X-Forwarded-For is enormous
I'm always getting great and helpful support from the CRS issue tracker: https://github.com/coreruleset/coreruleset/issues
-
Firewall made easy - Protect your web server traffic with UFW 🔥
Host-based firewalls and network firewalls won't always quite "cut it", OWASP ModSecurity is an open-source rule set for critical web applications that require an additional level of security.
-
[SL] MangaDex 3.0+1.0 Staff AMA
Other than that we rely on quite a lot of things these days, notably ModSecurity and the OWASP Core Rule Set alongside some other heavy restricting of our apps. (the idea being that the app is safe on its own, but those act as extra layers of defense in case we fuck up something really badly in the app one day)
-
Harden Apache2 Server
sudo git clone https://github.com/coreruleset/coreruleset /usr/share/modsecurity-crs
-
Cloudflare's inaccessible browser contradicts the company's mission
It's quite hard, because it's not just "use known vulnerabilities on this specific address" - you can block it easily, and there are projects (such as CRS: https://github.com/coreruleset/coreruleset) that tries to emulate this. It's more of combined specific attacks, which is amplified because if CloudFlare detected an attempt on a single high-profile site, then that IP address can be propagate to all of the protected properties. Combine that with how random is an address allocated in Tor, and you've got blocks without using an explicit Tor list.
What are some alternatives?
ClearURLs-Addon - ClearURLs is an add-on based on the new WebExtensions technology and will automatically remove tracking elements from URLs to help protect your privacy.
ModSecurity - ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx that is developed by Trustwave's SpiderLabs. It has a robust event-based programming language which provides protection from a range of attacks against web applications and allows for HTTP traffic monitoring, logging and real-time analysis. With over 10,000 deployments world-wide, ModSecurity is the most widely deployed WAF in existence.
awesome-yara - A curated list of awesome YARA rules, tools, and people.
ModSecurity-nginx - ModSecurity v3 Nginx Connector
bcc - BCC - Tools for BPF-based Linux IO analysis, networking, monitoring, and more
app - Repository to host app releases, issues, and feature requests for Paperback
bpftrace - High-level tracing language for Linux eBPF [Moved to: https://github.com/bpftrace/bpftrace]
Fider - Open platform to collect and prioritize feedback
Viewfinder - 📷 BrowserBox - Remote isolated browser API for security, automation visibility and interactivity. Run on our cloud, or bring your own. Full scope double reverse web proxy with multi-tab, mobile-ready browser UI frontend. Plus co-browsing, advanced adaptive streaming, secure document viewing and more! But only in the Pro version. Get BB today! Secure your document needs and internet, today! [Moved to: https://github.com/crisdosyago/BrowserBox]
guyamoe - Kaguya Manga Reader Website
mangadex_at_home
snuffleupagus - Security module for php7 and php8 - Killing bugclasses and virtual-patching the rest!