Caddy integration wazuh v4.14.6

[NucleiAv]

Description

This adds a decoder and detection ruleset for Caddy (caddyserver.com), a modern open source web server with automatic HTTPS that writes structured JSON access logs by default. There was no coverage for it anywhere in the Wazuh ruleset.

The integration includes a parent/child decoder pair and 29 rules covering path traversal, SQL injection, XSS, command injection, Log4Shell, LFI/RFI, SSRF, scanner and recon detection, credential and sensitive file access, source control exposure, encoding evasion, dangerous uploads, and brute force/scanning correlation. All rules use PCRE2 matching and are MITRE ATT&CK mapped.

Tested against a Wazuh manager 4.14.5 container using wazuh-logtest with the sample logs included in this folder, and against the full core ruleset test suite (caddy.ini, 26 passing cases, the 3 frequency based rules are excluded from that file since they need repeated events over time rather than a single log line).

Changes

• Added ruleset/decoders/caddy_decoders.xml, a parent/child decoder pair using JSON_Decoder to parse Caddy structured access logs
• Added ruleset/rules/caddy_rules.xml with 29 detection rules (IDs 996000-996032) covering SQLi, XSS, command injection, path traversal, Log4Shell, LFI/RFI, SSRF, scanner User-Agents, GraphQL introspection, upload abuse (web shell, double extension, archive/macro), dangerous HTTP methods, encoding evasion, oversized URIs, and brute force correlation. All rules are PCRE2-based and MITRE ATT&CK mapped.
• Added caddy.ini. It has 26 unit test cases covering all testable rules (3 frequency-based rules are commented out per convention)

Results and Evidence

All 26 tests passed with runtests.py on Wazuh v4.14.5:

|          File           |  Passed  |  Failed  |  Status  |
|        --------         | -------- | -------- | -------- |
|./caddy.ini        |    26    |    0     |    ✅    |

Sample wazuh-logtest output confirming rule firing:

id: '996012' | level: '15' | description: 'Caddy: Log4Shell JNDI injection attempt from 10.0.0.9'
id: '996025' | level: '12' | description: 'Caddy: SSRF attempt targeting internal resource from 10.1.0.3'
id: '996031' | level: '13' | description: 'Caddy: Double extension bypass upload attempt from 10.2.0.1'

and in detail:

**Phase 1: Completed pre-decoding.
        full event: '{"level":"info","ts":1781980011.0,"logger":"http.log.access.log0","msg":"handled request","request":{"remote_ip":"10.2.0.2","remote_port":"60011","client_ip":"10.2.0.2","proto":"HTTP/1.1","method":"POST","host":"localhost:8080","uri":"/uploads/malware.docm","headers":{"User-Agent":["Mozilla/5.0"],"Accept":["*/*"]}},"bytes_read":0,"user_id":"","duration":0.0001,"size":16,"status":200,"resp_headers":{"Server":["Caddy"],"Content-Type":["text/plain; charset=utf-8"]}}'

**Phase 2: Completed decoding.
        name: 'json'
        bytes_read: '0'
        duration: '0.000100'
        level: 'info'
        logger: 'http.log.access.log0'
        msg: 'handled request'
        request.client_ip: '10.2.0.2'
        request.headers.Accept: '['*/*']'
        request.headers.User-Agent: '['Mozilla/5.0']'
        request.host: 'localhost:8080'
        request.method: 'POST'
        request.proto: 'HTTP/1.1'
        request.remote_ip: '10.2.0.2'
        request.remote_port: '60011'
        request.uri: '/uploads/malware.docm'
        resp_headers.Content-Type: '['text/plain; charset=utf-8']'
        resp_headers.Server: '['Caddy']'
        size: '16'
        status: '200'
        ts: '1781980011'

**Phase 3: Completed filtering (rules).
        id: '996032'
        level: '8'
        description: 'Caddy: Archive or macro-enabled file upload from 10.2.0.2 - /uploads/malware.docm'
        groups: '['caddy', 'web', 'web', 'recon', 'upload']'
        firedtimes: '1'
        mail: 'False'
        mitre.id: '['T1566.001']'
        mitre.tactic: '['Initial Access']'
        mitre.technique: '['Spearphishing Attachment']'
**Alert to be generated.

Artifacts Introduced

• ruleset/decoders/caddy_decoders.xml
• ruleset/rules/caddy_rules.xml
• caddy.ini

Tests Introduced

26 unit test cases in ruleset/testing/tests/caddy.ini validated with runtests.py against a Wazuh v4.14.5 installation. Each test covers one rule with a real Caddy JSON access log line. Frequency-based rules (996018, 996019, 996022) are commented out per the existing convention in other .ini files.

[Copilot]

Pull request overview

Adds a new Wazuh integration for Caddy’s structured JSON access logs, providing decoders and a dedicated ruleset to detect common web attacks and reconnaissance activity.

Changes:

• Added Caddy JSON access-log decoder definitions.
• Added a Caddy-focused ruleset (IDs 996000–996032), including correlation/frequency rules.
• Added integration documentation, sample logs, and a ruleset test file (caddy.ini).

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
integrations/caddy_integration_wazuh_v4.14.6/ruleset/decoders/caddy_decoders.xml	Adds a parent/child decoder pair intended to identify and JSON-decode Caddy access logs.
integrations/caddy_integration_wazuh_v4.14.6/ruleset/rules/caddy_rules.xml	Adds 29 Caddy detection rules (including frequency-based correlation rules).
integrations/caddy_integration_wazuh_v4.14.6/caddy.ini	Adds unit-test style cases for the non-frequency rules.
integrations/caddy_integration_wazuh_v4.14.6/sample_logs.txt	Provides sample Caddy JSON log lines to validate decoding and rule hits via logtest.
integrations/caddy_integration_wazuh_v4.14.6/README.md	Documents setup, installation, and testing workflow for the integration.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.