valitydev/SigmaHQ
14
0
Fork 0
mirror of https://github.com/valitydev/SigmaHQ.git synced 2024-11-06 17:35:19 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Added vhost field to web rules

Browse Source
This commit is contained in:
Thomas Patzke 2017-09-17 00:20:17 +02:00
parent 270ab9ba78
commit 6b8a5aea4a
2 changed files with 2 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
rules/web/web_multiple_suspicious_resp_codes_single_source.yml
View File

@ -14,6 +14,7 @@ detection:
condition: selection | count() by clientip > 10 condition: selection | count() by clientip > 10
fields: fields:
- client_ip - client_ip
- vhost
- url - url
- response - response
falsepositives: falsepositives:

1
rules/web/web_webshell_keyword.yml
View File

@ -11,6 +11,7 @@ detection:
condition: keywords condition: keywords
fields: fields:
- client_ip - client_ip
- vhost
- url - url
- response - response
falsepositives: falsepositives: