根据domainid查询waf规则开启状态

{
  "code": 200,
  "message": "成功",
  "total": 47,
  "data": [
    {
      "level": 1,
      "app_name": "",
      "configuration_notes": "",
      "alert_message": "",
      "rule_class": "",
      "version": "",
      "action": "",
      "additional_information": "",
      "rule_id": 933011,
      "filename": "REQUEST-933-APPLICATION-ATTACK-PHP.conf",
      "transforms": "",
      "troubleshooting": "",
      "rule_factory_type": 1,
      "description": "",
      "outside_references": "",
      "tuning_guidance_notes": "",
      "log_types": "",
      "severity": "",
      "http_protocol_phase": "",
      "false_positives": "",
      "original_rule": "SecRule TX:DETECTION_PARANOIA_LEVEL \"@lt 1\" \"id:933011,phase:1,pass,nolog,skipAfter:END-REQUEST-933-APPLICATION-ATTACK-PHP\"",
      "name": "PHP代码执行攻击防护规则-1",
      "http_status": "",
      "similar_rules": ""
    },
    {
      "level": 1,
      "app_name": "",
      "configuration_notes": "",
      "alert_message": "",
      "rule_class": "",
      "version": "",
      "action": "",
      "additional_information": "",
      "rule_id": 933012,
      "filename": "REQUEST-933-APPLICATION-ATTACK-PHP.conf",
      "transforms": "",
      "troubleshooting": "",
      "rule_factory_type": 1,
      "description": "",
      "outside_references": "",
      "tuning_guidance_notes": "",
      "log_types": "",
      "severity": "",
      "http_protocol_phase": "",
      "false_positives": "",
      "original_rule": "SecRule TX:DETECTION_PARANOIA_LEVEL \"@lt 1\" \"id:933012,phase:2,pass,nolog,skipAfter:END-REQUEST-933-APPLICATION-ATTACK-PHP\"",
      "name": "PHP代码执行攻击防护规则-2",
      "http_status": "",
      "similar_rules": ""
    },
    {
      "level": 3,
      "app_name": "",
      "configuration_notes": "",
      "alert_message": "",
      "rule_class": "",
      "version": "",
      "action": "",
      "additional_information": "",
      "rule_id": 933100,
      "filename": "REQUEST-933-APPLICATION-ATTACK-PHP.conf",
      "transforms": "",
      "troubleshooting": "",
      "rule_factory_type": 1,
      "description": "PHP注入攻击:发现PHP打开标签",
      "outside_references": "",
      "tuning_guidance_notes": "",
      "log_types": "",
      "severity": "",
      "http_protocol_phase": "",
      "false_positives": "",
      "original_rule": "SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/* \"@rx (?:<\\?(?:[^x]|x[^m]|xm[^l]|xml[^\\s]|xml$|$)|<\\?php|\\[(?:/|\\x5c)?php\\])\" \\\n    \"id:933100,\\\n    phase:2,\\\n    block,\\\n    capture,\\\n    t:none,t:lowercase,\\\n    msg:'PHP Injection Attack: PHP Open Tag Found',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-php',\\\n    tag:'platform-multi',\\\n    tag:'attack-injection-php',\\\n    tag:'paranoia-level/1',\\\n    tag:'OWASP_CRS',\\\n    tag:'capec/1000/152/242',\\\n    ver:'OWASP_CRS/4.0.0-rc2',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.php_injection_score=+%{tx.critical_anomaly_score}',\\\n    setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'\"",
      "name": "PHP代码执行攻击防护规则-3",
      "http_status": "",
      "similar_rules": ""
    },
    {
      "level": 3,
      "app_name": "",
      "configuration_notes": "",
      "alert_message": "",
      "rule_class": "",
      "version": "",
      "action": "",
      "additional_information": "",
      "rule_id": 933110,
      "filename": "REQUEST-933-APPLICATION-ATTACK-PHP.conf",
      "transforms": "",
      "troubleshooting": "",
      "rule_factory_type": 1,
      "description": "PHP注入攻击:发现PHP脚本文件上传",
      "outside_references": "",
      "tuning_guidance_notes": "",
      "log_types": "",
      "severity": "",
      "http_protocol_phase": "",
      "false_positives": "",
      "original_rule": "SecRule FILES|REQUEST_HEADERS:X-Filename|REQUEST_HEADERS:X_Filename|REQUEST_HEADERS:X.Filename|REQUEST_HEADERS:X-File-Name \"@rx .*\\.ph(?:p\\d*|tml|ar|ps|t|pt)\\.*$\" \"id:933110,phase:2,block,capture,t:none,t:lowercase,msg:'PHP Injection Attack: PHP Script File Upload Found',logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',tag:'application-multi',tag:'language-php',tag:'platform-multi',tag:'attack-injection-php',tag:'paranoia-level/1',tag:'OWASP_CRS',tag:'capec/1000/152/242',ver:'OWASP_CRS/4.0.0-rc2',severity:'CRITICAL',setvar:'tx.php_injection_score=+%{tx.critical_anomaly_score}',setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'\"",
      "name": "PHP代码执行攻击防护规则-4",
      "http_status": "",
      "similar_rules": ""
    },
    {
      "level": 3,
      "app_name": "",
      "configuration_notes": "",
      "alert_message": "",
      "rule_class": "",
      "version": "",
      "action": "",
      "additional_information": "",
      "rule_id": 933120,
      "filename": "REQUEST-933-APPLICATION-ATTACK-PHP.conf",
      "transforms": "",
      "troubleshooting": "",
      "rule_factory_type": 1,
      "description": "PHP注入攻击:发现配置指令",
      "outside_references": "",
      "tuning_guidance_notes": "",
      "log_types": "",
      "severity": "",
      "http_protocol_phase": "",
      "false_positives": "",
      "original_rule": "SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/* \"@pmFromFile ./waf_rules/php-config-directives.data\" \\\n    \"id:933120,\\\n    phase:2,\\\n    block,\\\n    capture,\\\n    t:none,t:normalisePath,\\\n    msg:'PHP Injection Attack: Configuration Directive Found',\\\n    logdata:'Matched Data: %{TX.933120_TX_0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-php',\\\n    tag:'platform-multi',\\\n    tag:'attack-injection-php',\\\n    tag:'paranoia-level/1',\\\n    tag:'OWASP_CRS',\\\n    tag:'capec/1000/152/242',\\\n    ver:'OWASP_CRS/4.0.0-rc2',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.933120_tx_0=%{tx.0}',\\\n    chain\"\n    SecRule MATCHED_VARS \"@pm =\" \\\n        \"capture,\\\n        setvar:'tx.php_injection_score=+%{tx.critical_anomaly_score}',\\\n        setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'\"",
      "name": "PHP代码执行攻击防护规则-5",
      "http_status": "",
      "similar_rules": ""
    },
    {
      "level": 3,
      "app_name": "",
      "configuration_notes": "",
      "alert_message": "",
      "rule_class": "",
      "version": "",
      "action": "",
      "additional_information": "",
      "rule_id": 933130,
      "filename": "REQUEST-933-APPLICATION-ATTACK-PHP.conf",
      "transforms": "",
      "troubleshooting": "",
      "rule_factory_type": 1,
      "description": "PHP注入攻击:发现变量",
      "outside_references": "",
      "tuning_guidance_notes": "",
      "log_types": "",
      "severity": "",
      "http_protocol_phase": "",
      "false_positives": "",
      "original_rule": "SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/* \"@pmFromFile ./waf_rules/php-variables.data\" \\\n    \"id:933130,\\\n    phase:2,\\\n    block,\\\n    capture,\\\n    t:none,t:normalisePath,t:urlDecodeUni,\\\n    msg:'PHP Injection Attack: Variables Found',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-php',\\\n    tag:'platform-multi',\\\n    tag:'attack-injection-php',\\\n    tag:'paranoia-level/1',\\\n    tag:'OWASP_CRS',\\\n    tag:'capec/1000/152/242',\\\n    ver:'OWASP_CRS/4.0.0-rc2',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.php_injection_score=+%{tx.critical_anomaly_score}',\\\n    setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'\"",
      "name": "PHP代码执行攻击防护规则-6",
      "http_status": "",
      "similar_rules": ""
    },
    {
      "level": 3,
      "app_name": "",
      "configuration_notes": "",
      "alert_message": "",
      "rule_class": "",
      "version": "",
      "action": "",
      "additional_information": "",
      "rule_id": 933140,
      "filename": "REQUEST-933-APPLICATION-ATTACK-PHP.conf",
      "transforms": "",
      "troubleshooting": "",
      "rule_factory_type": 1,
      "description": "PHP注入攻击:发现I/O流",
      "outside_references": "",
      "tuning_guidance_notes": "",
      "log_types": "",
      "severity": "",
      "http_protocol_phase": "",
      "false_positives": "",
      "original_rule": "SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/* \"@rx (?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)\" \\\n    \"id:933140,\\\n    phase:2,\\\n    block,\\\n    capture,\\\n    t:none,\\\n    msg:'PHP Injection Attack: I/O Stream Found',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-php',\\\n    tag:'platform-multi',\\\n    tag:'attack-injection-php',\\\n    tag:'paranoia-level/1',\\\n    tag:'OWASP_CRS',\\\n    tag:'capec/1000/152/242',\\\n    ver:'OWASP_CRS/4.0.0-rc2',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.php_injection_score=+%{tx.critical_anomaly_score}',\\\n    setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'\"",
      "name": "PHP代码执行攻击防护规则-7",
      "http_status": "",
      "similar_rules": ""
    },
    {
      "level": 3,
      "app_name": "",
      "configuration_notes": "",
      "alert_message": "",
      "rule_class": "",
      "version": "",
      "action": "",
      "additional_information": "",
      "rule_id": 933200,
      "filename": "REQUEST-933-APPLICATION-ATTACK-PHP.conf",
      "transforms": "",
      "troubleshooting": "",
      "rule_factory_type": 1,
      "description": "PHP注入攻击:检测到包装器方案",
      "outside_references": "",
      "tuning_guidance_notes": "",
      "log_types": "",
      "severity": "",
      "http_protocol_phase": "",
      "false_positives": "",
      "original_rule": "SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/* \"@rx (?:bzip2|expect|glob|ogg|(?:ph|r)ar|ssh2(?:.(?:s(?:hell|(?:ft|c)p)|exec|tunnel))?|z(?:ip|lib))://\" \\\n    \"id:933200,\\\n    phase:2,\\\n    block,\\\n    t:none,t:utf8toUnicode,t:urlDecodeUni,t:removeNulls,t:cmdLine,\\\n    msg:'PHP Injection Attack: Wrapper scheme detected',\\\n    logdata:'Matched Data: %{MATCHED_VAR} found within %{MATCHED_VAR_NAME}',\\\n    tag:'application-multi',\\\n    tag:'language-php',\\\n    tag:'platform-multi',\\\n    tag:'attack-injection-php',\\\n    tag:'paranoia-level/1',\\\n    tag:'OWASP_CRS',\\\n    tag:'capec/1000/152/242',\\\n    ver:'OWASP_CRS/4.0.0-rc2',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.php_injection_score=+%{tx.critical_anomaly_score}',\\\n    setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'\"",
      "name": "PHP代码执行攻击防护规则-8",
      "http_status": "",
      "similar_rules": ""
    },
    {
      "level": 3,
      "app_name": "",
      "configuration_notes": "",
      "alert_message": "",
      "rule_class": "",
      "version": "",
      "action": "",
      "additional_information": "",
      "rule_id": 933150,
      "filename": "REQUEST-933-APPLICATION-ATTACK-PHP.conf",
      "transforms": "",
      "troubleshooting": "",
      "rule_factory_type": 1,
      "description": "PHP注入攻击:发现高危PHP函数名",
      "outside_references": "",
      "tuning_guidance_notes": "",
      "log_types": "",
      "severity": "",
      "http_protocol_phase": "",
      "false_positives": "",
      "original_rule": "SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|REQUEST_FILENAME|ARGS_NAMES|ARGS|XML:/* \"@pmFromFile ./waf_rules/php-function-names-933150.data\" \\\n    \"id:933150,\\\n    phase:2,\\\n    block,\\\n    capture,\\\n    t:none,\\\n    msg:'PHP Injection Attack: High-Risk PHP Function Name Found',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-php',\\\n    tag:'platform-multi',\\\n    tag:'attack-injection-php',\\\n    tag:'paranoia-level/1',\\\n    tag:'OWASP_CRS',\\\n    tag:'capec/1000/152/242',\\\n    ver:'OWASP_CRS/4.0.0-rc2',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.php_injection_score=+%{tx.critical_anomaly_score}',\\\n    setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'\"",
      "name": "PHP代码执行攻击防护规则-9",
      "http_status": "",
      "similar_rules": ""
    },
    {
      "level": 3,
      "app_name": "",
      "configuration_notes": "",
      "alert_message": "",
      "rule_class": "",
      "version": "",
      "action": "",
      "additional_information": "",
      "rule_id": 933160,
      "filename": "REQUEST-933-APPLICATION-ATTACK-PHP.conf",
      "transforms": "",
      "troubleshooting": "",
      "rule_factory_type": 1,
      "description": "PHP注入攻击:发现高风险PHP函数调用",
      "outside_references": "",
      "tuning_guidance_notes": "",
      "log_types": "",
      "severity": "",
      "http_protocol_phase": "",
      "false_positives": "",
      "original_rule": "SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|REQUEST_FILENAME|ARGS_NAMES|ARGS|XML:/* \"@rx (?i)\\b\\(?[\\\"']*(?:assert(?:_options)?|c(?:hr|reate_function)|e(?:val|x(?:ec|p))|file(?:group)?|glob|i(?:mage(?:gif|(?:jpe|pn)g|wbmp|xbm)|s_a)|md5|o(?:pendir|rd)|p(?:assthru|open|rev)|(?:read|tmp)file|un(?:pac|lin)k|s(?:tat|ubstr|ystem))(?:/(?:\\*.*\\*/|/.*)|#.*[\\s\\v]|\\\")*[\\\"']*\\)?[\\s\\v]*\\(.*\\)\" \\\n    \"id:933160,\\\n    phase:2,\\\n    block,\\\n    capture,\\\n    t:none,\\\n    msg:'PHP Injection Attack: High-Risk PHP Function Call Found',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-php',\\\n    tag:'platform-multi',\\\n    tag:'attack-injection-php',\\\n    tag:'paranoia-level/1',\\\n    tag:'OWASP_CRS',\\\n    tag:'capec/1000/152/242',\\\n    ver:'OWASP_CRS/4.0.0-rc2',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.php_injection_score=+%{tx.critical_anomaly_score}',\\\n    setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'\"",
      "name": "PHP代码执行攻击防护规则-10",
      "http_status": "",
      "similar_rules": ""
    },
    {
      "level": 3,
      "app_name": "",
      "configuration_notes": "",
      "alert_message": "",
      "rule_class": "",
      "version": "",
      "action": "",
      "additional_information": "",
      "rule_id": 933170,
      "filename": "REQUEST-933-APPLICATION-ATTACK-PHP.conf",
      "transforms": "",
      "troubleshooting": "",
      "rule_factory_type": 1,
      "description": "PHP注入攻击:序列化对象注入",
      "outside_references": "",
      "tuning_guidance_notes": "",
      "log_types": "",
      "severity": "",
      "http_protocol_phase": "",
      "false_positives": "",
      "original_rule": "SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|REQUEST_HEADERS|ARGS_NAMES|ARGS|XML:/* \"@rx [oOcC]:\\d+:\\\".+?\\\":\\d+:{.*}\" \\\n    \"id:933170,\\\n    phase:2,\\\n    block,\\\n    capture,\\\n    t:none,\\\n    msg:'PHP Injection Attack: Serialized Object Injection',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-php',\\\n    tag:'platform-multi',\\\n    tag:'attack-injection-php',\\\n    tag:'paranoia-level/1',\\\n    tag:'OWASP_CRS',\\\n    tag:'capec/1000/152/242',\\\n    ver:'OWASP_CRS/4.0.0-rc2',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.php_injection_score=+%{tx.critical_anomaly_score}',\\\n    setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'\"",
      "name": "PHP代码执行攻击防护规则-11",
      "http_status": "",
      "similar_rules": ""
    },
    {
      "level": 3,
      "app_name": "",
      "configuration_notes": "",
      "alert_message": "",
      "rule_class": "",
      "version": "",
      "action": "",
      "additional_information": "",
      "rule_id": 933180,
      "filename": "REQUEST-933-APPLICATION-ATTACK-PHP.conf",
      "transforms": "",
      "troubleshooting": "",
      "rule_factory_type": 1,
      "description": "PHP注入攻击:发现变量函数调用",
      "outside_references": "",
      "tuning_guidance_notes": "",
      "log_types": "",
      "severity": "",
      "http_protocol_phase": "",
      "false_positives": "",
      "original_rule": "SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|REQUEST_FILENAME|ARGS_NAMES|ARGS|XML:/* \"@rx \\$+(?:[a-zA-Z_\\x7f-\\xff][a-zA-Z0-9_\\x7f-\\xff]*|\\s*{.+})(?:\\s|\\[.+\\]|{.+}|/\\*.*\\*/|//.*|#.*)*\\(.*\\)\" \\\n    \"id:933180,\\\n    phase:2,\\\n    block,\\\n    capture,\\\n    t:none,\\\n    msg:'PHP Injection Attack: Variable Function Call Found',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-php',\\\n    tag:'platform-multi',\\\n    tag:'attack-injection-php',\\\n    tag:'paranoia-level/1',\\\n    tag:'OWASP_CRS',\\\n    tag:'capec/1000/152/242',\\\n    ver:'OWASP_CRS/4.0.0-rc2',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.php_injection_score=+%{tx.critical_anomaly_score}',\\\n    setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'\"",
      "name": "PHP代码执行攻击防护规则-12",
      "http_status": "",
      "similar_rules": ""
    },
    {
      "level": 3,
      "app_name": "",
      "configuration_notes": "",
      "alert_message": "",
      "rule_class": "",
      "version": "",
      "action": "",
      "additional_information": "",
      "rule_id": 933210,
      "filename": "REQUEST-933-APPLICATION-ATTACK-PHP.conf",
      "transforms": "",
      "troubleshooting": "",
      "rule_factory_type": 1,
      "description": "PHP注入攻击:发现变量函数调用",
      "outside_references": "",
      "tuning_guidance_notes": "",
      "log_types": "",
      "severity": "",
      "http_protocol_phase": "",
      "false_positives": "",
      "original_rule": "SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|REQUEST_FILENAME|ARGS_NAMES|ARGS|XML:/* \"@rx (?:\\((?:.+\\)(?:[\\\"'][\\-0-9A-Z_a-z]+[\\\"'])?\\(.+|[^\\)]*string[^\\)]*\\)[\\s\\v\\\"'\\--\\.0-9A-\\[\\]_a-\\{\\}]+\\([^\\)]*)|(?:\\[[0-9]+\\]|\\{[0-9]+\\}|\\$[^\\(-\\),\\.-/;\\x5c]+|[\\\"'][\\-0-9A-Z\\x5c_a-z]+[\\\"'])\\(.+)\\);\" \\\n    \"id:933210,\\\n    phase:2,\\\n    block,\\\n    capture,\\\n    t:none,t:urlDecode,t:replaceComments,t:removeWhitespace,\\\n    msg:'PHP Injection Attack: Variable Function Call Found',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-php',\\\n    tag:'platform-multi',\\\n    tag:'attack-injection-php',\\\n    tag:'paranoia-level/1',\\\n    tag:'OWASP_CRS',\\\n    tag:'capec/1000/152/242',\\\n    ver:'OWASP_CRS/4.0.0-rc2',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.php_injection_score=+%{tx.critical_anomaly_score}',\\\n    setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'\"",
      "name": "PHP代码执行攻击防护规则-13",
      "http_status": "",
      "similar_rules": ""
    },
    {
      "level": 1,
      "app_name": "",
      "configuration_notes": "",
      "alert_message": "",
      "rule_class": "",
      "version": "",
      "action": "",
      "additional_information": "",
      "rule_id": 933013,
      "filename": "REQUEST-933-APPLICATION-ATTACK-PHP.conf",
      "transforms": "",
      "troubleshooting": "",
      "rule_factory_type": 1,
      "description": "",
      "outside_references": "",
      "tuning_guidance_notes": "",
      "log_types": "",
      "severity": "",
      "http_protocol_phase": "",
      "false_positives": "",
      "original_rule": "SecRule TX:DETECTION_PARANOIA_LEVEL \"@lt 2\" \"id:933013,phase:1,pass,nolog,skipAfter:END-REQUEST-933-APPLICATION-ATTACK-PHP\"",
      "name": "PHP代码执行攻击防护规则-14",
      "http_status": "",
      "similar_rules": ""
    },
    {
      "level": 1,
      "app_name": "",
      "configuration_notes": "",
      "alert_message": "",
      "rule_class": "",
      "version": "",
      "action": "",
      "additional_information": "",
      "rule_id": 933014,
      "filename": "REQUEST-933-APPLICATION-ATTACK-PHP.conf",
      "transforms": "",
      "troubleshooting": "",
      "rule_factory_type": 1,
      "description": "",
      "outside_references": "",
      "tuning_guidance_notes": "",
      "log_types": "",
      "severity": "",
      "http_protocol_phase": "",
      "false_positives": "",
      "original_rule": "SecRule TX:DETECTION_PARANOIA_LEVEL \"@lt 2\" \"id:933014,phase:2,pass,nolog,skipAfter:END-REQUEST-933-APPLICATION-ATTACK-PHP\"",
      "name": "PHP代码执行攻击防护规则-15",
      "http_status": "",
      "similar_rules": ""
    },
    {
      "level": 3,
      "app_name": "",
      "configuration_notes": "",
      "alert_message": "",
      "rule_class": "",
      "version": "",
      "action": "",
      "additional_information": "",
      "rule_id": 933151,
      "filename": "REQUEST-933-APPLICATION-ATTACK-PHP.conf",
      "transforms": "",
      "troubleshooting": "",
      "rule_factory_type": 1,
      "description": "PHP注入攻击:发现中等风险的PHP函数名",
      "outside_references": "",
      "tuning_guidance_notes": "",
      "log_types": "",
      "severity": "",
      "http_protocol_phase": "",
      "false_positives": "",
      "original_rule": "SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|REQUEST_FILENAME|ARGS_NAMES|ARGS|XML:/* \"@pmFromFile ./waf_rules/php-function-names-933151.data\" \\\n    \"id:933151,\\\n    phase:2,\\\n    block,\\\n    capture,\\\n    t:none,\\\n    msg:'PHP Injection Attack: Medium-Risk PHP Function Name Found',\\\n    logdata:'Matched Data: %{TX.933151_TX_0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-php',\\\n    tag:'platform-multi',\\\n    tag:'attack-injection-php',\\\n    tag:'OWASP_CRS',\\\n    tag:'capec/1000/152/242',\\\n    tag:'paranoia-level/2',\\\n    ver:'OWASP_CRS/4.0.0-rc2',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.933151_tx_0=%{tx.0}',\\\n    chain\"\n    SecRule MATCHED_VARS \"@pm (\" \\\n        \"capture,\\\n        setvar:'tx.php_injection_score=+%{tx.critical_anomaly_score}',\\\n        setvar:'tx.inbound_anomaly_score_pl2=+%{tx.critical_anomaly_score}'\"",
      "name": "PHP代码执行攻击防护规则-16",
      "http_status": "",
      "similar_rules": ""
    },
    {
      "level": 1,
      "app_name": "",
      "configuration_notes": "",
      "alert_message": "",
      "rule_class": "",
      "version": "",
      "action": "",
      "additional_information": "",
      "rule_id": 933015,
      "filename": "REQUEST-933-APPLICATION-ATTACK-PHP.conf",
      "transforms": "",
      "troubleshooting": "",
      "rule_factory_type": 1,
      "description": "",
      "outside_references": "",
      "tuning_guidance_notes": "",
      "log_types": "",
      "severity": "",
      "http_protocol_phase": "",
      "false_positives": "",
      "original_rule": "SecRule TX:DETECTION_PARANOIA_LEVEL \"@lt 3\" \"id:933015,phase:1,pass,nolog,skipAfter:END-REQUEST-933-APPLICATION-ATTACK-PHP\"",
      "name": "PHP代码执行攻击防护规则-17",
      "http_status": "",
      "similar_rules": ""
    },
    {
      "level": 1,
      "app_name": "",
      "configuration_notes": "",
      "alert_message": "",
      "rule_class": "",
      "version": "",
      "action": "",
      "additional_information": "",
      "rule_id": 933016,
      "filename": "REQUEST-933-APPLICATION-ATTACK-PHP.conf",
      "transforms": "",
      "troubleshooting": "",
      "rule_factory_type": 1,
      "description": "",
      "outside_references": "",
      "tuning_guidance_notes": "",
      "log_types": "",
      "severity": "",
      "http_protocol_phase": "",
      "false_positives": "",
      "original_rule": "SecRule TX:DETECTION_PARANOIA_LEVEL \"@lt 3\" \"id:933016,phase:2,pass,nolog,skipAfter:END-REQUEST-933-APPLICATION-ATTACK-PHP\"",
      "name": "PHP代码执行攻击防护规则-18",
      "http_status": "",
      "similar_rules": ""
    },
    {
      "level": 3,
      "app_name": "",
      "configuration_notes": "",
      "alert_message": "",
      "rule_class": "",
      "version": "",
      "action": "",
      "additional_information": "",
      "rule_id": 933131,
      "filename": "REQUEST-933-APPLICATION-ATTACK-PHP.conf",
      "transforms": "",
      "troubleshooting": "",
      "rule_factory_type": 1,
      "description": "PHP注入攻击:发现变量",
      "outside_references": "",
      "tuning_guidance_notes": "",
      "log_types": "",
      "severity": "",
      "http_protocol_phase": "",
      "false_positives": "",
      "original_rule": "SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/* \"@rx AUTH_TYPE|HTTP_(?:ACCEPT(?:_(?:CHARSET|ENCODING|LANGUAGE))?|CONNECTION|(?:HOS|USER_AGEN)T|KEEP_ALIVE|(?:REFERE|X_FORWARDED_FO)R)|ORIG_PATH_INFO|PATH_(?:INFO|TRANSLATED)|QUERY_STRING|REQUEST_URI\" \\\n    \"id:933131,\\\n    phase:2,\\\n    block,\\\n    capture,\\\n    t:none,t:normalisePath,t:urlDecodeUni,\\\n    msg:'PHP Injection Attack: Variables Found',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-php',\\\n    tag:'platform-multi',\\\n    tag:'attack-injection-php',\\\n    tag:'OWASP_CRS',\\\n    tag:'capec/1000/152/242',\\\n    tag:'paranoia-level/3',\\\n    ver:'OWASP_CRS/4.0.0-rc2',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.php_injection_score=+%{tx.critical_anomaly_score}',\\\n    setvar:'tx.inbound_anomaly_score_pl3=+%{tx.critical_anomaly_score}'\"",
      "name": "PHP代码执行攻击防护规则-19",
      "http_status": "",
      "similar_rules": ""
    },
    {
      "level": 3,
      "app_name": "",
      "configuration_notes": "",
      "alert_message": "",
      "rule_class": "",
      "version": "",
      "action": "",
      "additional_information": "",
      "rule_id": 933161,
      "filename": "REQUEST-933-APPLICATION-ATTACK-PHP.conf",
      "transforms": "",
      "troubleshooting": "",
      "rule_factory_type": 1,
      "description": "PHP注入攻击:发现低值PHP函数调用",
      "outside_references": "",
      "tuning_guidance_notes": "",
      "log_types": "",
      "severity": "",
      "http_protocol_phase": "",
      "false_positives": "",
      "original_rule": "SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|REQUEST_FILENAME|ARGS_NAMES|ARGS|XML:/* \"@rx (?i)\\b(?:a(?:bs|s(?:in|sert(?:_options)?))|basename|c(?:h(?:eckdate|r(?:oot)?)|o(?:(?:mpac|(?:nsta|u)n)t|py|sh?)|r(?:eate_function|ypt)|urrent)|d(?:ate|e(?:coct|fined?)|ir)|e(?:nd|val|x(?:ec|p(?:lode)?|tract))|f(?:ile(?:(?:[acm]tim|inod|siz|typ)e|group|owner|perms)?|l(?:o(?:ck|or)|ush))|glob|h(?:ash|eader)|i(?:date|m(?:age(?:gif|(?:jpe|pn)g|wbmp|xbm)|plode)|s_a)|key|l(?:ink|og)|m(?:a(?:il|x)|d5|in)|n(?:ame|ext)|o(?:pendir|rd)|p(?:a(?:ck|ss(?:thru)?)|i|o(?:pen|w)|rev)|r(?:an(?:d|ge)|e(?:(?:adfil|nam)e|set)|ound)|s(?:(?:erializ|huffl)e|in|leep|(?:or|ta)t|ubstr|y(?:mlink|s(?:log|tem)))|t(?:an|(?:im|mpfil)e|ouch|rim)|u(?:cfirst|n(?:lin|pac)k)|virtual)(?:[\\s\\v]|/\\*.*\\*/|(?:#|//).*)*\\(.*\\)\" \\\n    \"id:933161,\\\n    phase:2,\\\n    block,\\\n    capture,\\\n    t:none,\\\n    msg:'PHP Injection Attack: Low-Value PHP Function Call Found',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-php',\\\n    tag:'platform-multi',\\\n    tag:'attack-injection-php',\\\n    tag:'OWASP_CRS',\\\n    tag:'capec/1000/152/242',\\\n    tag:'paranoia-level/3',\\\n    ver:'OWASP_CRS/4.0.0-rc2',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.php_injection_score=+%{tx.critical_anomaly_score}',\\\n    setvar:'tx.inbound_anomaly_score_pl3=+%{tx.critical_anomaly_score}'\"",
      "name": "PHP代码执行攻击防护规则-20",
      "http_status": "",
      "similar_rules": ""
    },
    {
      "level": 3,
      "app_name": "",
      "configuration_notes": "",
      "alert_message": "",
      "rule_class": "",
      "version": "",
      "action": "",
      "additional_information": "",
      "rule_id": 933111,
      "filename": "REQUEST-933-APPLICATION-ATTACK-PHP.conf",
      "transforms": "",
      "troubleshooting": "",
      "rule_factory_type": 1,
      "description": "PHP注入攻击:发现PHP脚本文件上传",
      "outside_references": "",
      "tuning_guidance_notes": "",
      "log_types": "",
      "severity": "",
      "http_protocol_phase": "",
      "false_positives": "",
      "original_rule": "SecRule FILES|REQUEST_HEADERS:X-Filename|REQUEST_HEADERS:X_Filename|REQUEST_HEADERS:X.Filename|REQUEST_HEADERS:X-File-Name \"@rx .*\\.(?:php\\d*|phtml)\\..*$\" \"id:933111,phase:2,block,capture,t:none,t:lowercase,msg:'PHP Injection Attack: PHP Script File Upload Found',logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',tag:'application-multi',tag:'language-php',tag:'platform-multi',tag:'attack-injection-php',tag:'OWASP_CRS',tag:'capec/1000/152/242',tag:'paranoia-level/3',ver:'OWASP_CRS/4.0.0-rc2',severity:'CRITICAL',setvar:'tx.php_injection_score=+%{tx.critical_anomaly_score}',setvar:'tx.inbound_anomaly_score_pl3=+%{tx.critical_anomaly_score}'\"",
      "name": "PHP代码执行攻击防护规则-21",
      "http_status": "",
      "similar_rules": ""
    },
    {
      "level": 3,
      "app_name": "",
      "configuration_notes": "",
      "alert_message": "",
      "rule_class": "",
      "version": "",
      "action": "",
      "additional_information": "",
      "rule_id": 933190,
      "filename": "REQUEST-933-APPLICATION-ATTACK-PHP.conf",
      "transforms": "",
      "troubleshooting": "",
      "rule_factory_type": 1,
      "description": "PHP注入攻击:发现PHP关闭标签",
      "outside_references": "",
      "tuning_guidance_notes": "",
      "log_types": "",
      "severity": "",
      "http_protocol_phase": "",
      "false_positives": "",
      "original_rule": "SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/* \"@pm ?>\" \\\n    \"id:933190,\\\n    phase:2,\\\n    block,\\\n    capture,\\\n    t:none,t:urlDecodeUni,\\\n    msg:'PHP Injection Attack: PHP Closing Tag Found',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-php',\\\n    tag:'platform-multi',\\\n    tag:'attack-injection-php',\\\n    tag:'OWASP_CRS',\\\n    tag:'capec/1000/152/242',\\\n    tag:'paranoia-level/3',\\\n    ver:'OWASP_CRS/4.0.0-rc2',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.php_injection_score=+%{tx.critical_anomaly_score}',\\\n    setvar:'tx.inbound_anomaly_score_pl3=+%{tx.critical_anomaly_score}'\"",
      "name": "PHP代码执行攻击防护规则-22",
      "http_status": "",
      "similar_rules": ""
    },
    {
      "level": 3,
      "app_name": "",
      "configuration_notes": "",
      "alert_message": "",
      "rule_class": "",
      "version": "",
      "action": "",
      "additional_information": "",
      "rule_id": 933211,
      "filename": "REQUEST-933-APPLICATION-ATTACK-PHP.conf",
      "transforms": "",
      "troubleshooting": "",
      "rule_factory_type": 1,
      "description": "PHP注入攻击:发现变量函数调用",
      "outside_references": "",
      "tuning_guidance_notes": "",
      "log_types": "",
      "severity": "",
      "http_protocol_phase": "",
      "false_positives": "",
      "original_rule": "SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|REQUEST_FILENAME|ARGS_NAMES|ARGS|XML:/* \"@rx (?:\\((?:.+\\)(?:[\\\"'][\\-0-9A-Z_a-z]+[\\\"'])?\\(.+|[^\\)]*string[^\\)]*\\)[\\s\\v\\\"'\\--\\.0-9A-\\[\\]_a-\\{\\}]+\\([^\\)]*)|(?:\\[[0-9]+\\]|\\{[0-9]+\\}|\\$[^\\(-\\),\\.-/;\\x5c]+|[\\\"'][\\-0-9A-Z\\x5c_a-z]+[\\\"'])\\(.+)\\)(?:;|$)?\" \\\n    \"id:933211,\\\n    phase:2,\\\n    block,\\\n    capture,\\\n    t:none,t:urlDecode,t:replaceComments,t:removeWhitespace,\\\n    msg:'PHP Injection Attack: Variable Function Call Found',\\\n    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\\\n    tag:'application-multi',\\\n    tag:'language-php',\\\n    tag:'platform-multi',\\\n    tag:'attack-injection-php',\\\n    tag:'paranoia-level/3',\\\n    tag:'OWASP_CRS',\\\n    tag:'capec/1000/152/242',\\\n    ver:'OWASP_CRS/4.0.0-rc2',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.php_injection_score=+%{tx.critical_anomaly_score}',\\\n    setvar:'tx.inbound_anomaly_score_pl3=+%{tx.critical_anomaly_score}'\"",
      "name": "PHP代码执行攻击防护规则-23",
      "http_status": "",
      "similar_rules": ""
    },
    {
      "level": 1,
      "app_name": "",
      "configuration_notes": "",
      "alert_message": "",
      "rule_class": "",
      "version": "",
      "action": "",
      "additional_information": "",
      "rule_id": 933017,
      "filename": "REQUEST-933-APPLICATION-ATTACK-PHP.conf",
      "transforms": "",
      "troubleshooting": "",
      "rule_factory_type": 1,
      "description": "",
      "outside_references": "",
      "tuning_guidance_notes": "",
      "log_types": "",
      "severity": "",
      "http_protocol_phase": "",
      "false_positives": "",
      "original_rule": "SecRule TX:DETECTION_PARANOIA_LEVEL \"@lt 4\" \"id:933017,phase:1,pass,nolog,skipAfter:END-REQUEST-933-APPLICATION-ATTACK-PHP\"",
      "name": "PHP代码执行攻击防护规则-24",
      "http_status": "",
      "similar_rules": ""
    },
    {
      "level": 1,
      "app_name": "",
      "configuration_notes": "",
      "alert_message": "",
      "rule_class": "",
      "version": "",
      "action": "",
      "additional_information": "",
      "rule_id": 933018,
      "filename": "REQUEST-933-APPLICATION-ATTACK-PHP.conf",
      "transforms": "",
      "troubleshooting": "",
      "rule_factory_type": 1,
      "description": "",
      "outside_references": "",
      "tuning_guidance_notes": "",
      "log_types": "",
      "severity": "",
      "http_protocol_phase": "",
      "false_positives": "",
      "original_rule": "SecRule TX:DETECTION_PARANOIA_LEVEL \"@lt 4\" \"id:933018,phase:2,pass,nolog,skipAfter:END-REQUEST-933-APPLICATION-ATTACK-PHP\"",
      "name": "PHP代码执行攻击防护规则-25",
      "http_status": "",
      "similar_rules": ""
    },
    {
      "level": 1,
      "app_name": "",
      "configuration_notes": "",
      "alert_message": "",
      "rule_class": "",
      "version": "",
      "action": "",
      "additional_information": "",
      "rule_id": 944011,
      "filename": "REQUEST-944-APPLICATION-ATTACK-JAVA.conf",
      "transforms": "",
      "troubleshooting": "",
      "rule_factory_type": 1,
      "description": "",
      "outside_references": "",
      "tuning_guidance_notes": "",
      "log_types": "",
      "severity": "",
      "http_protocol_phase": "",
      "false_positives": "",
      "original_rule": "SecRule TX:DETECTION_PARANOIA_LEVEL \"@lt 1\" \"id:944011,phase:1,pass,nolog,skipAfter:END-REQUEST-944-APPLICATION-ATTACK-JAVA\"",
      "name": "JAVA漏洞攻击防护规则-1",
      "http_status": "",
      "similar_rules": ""
    },
    {
      "level": 1,
      "app_name": "",
      "configuration_notes": "",
      "alert_message": "",
      "rule_class": "",
      "version": "",
      "action": "",
      "additional_information": "",
      "rule_id": 944012,
      "filename": "REQUEST-944-APPLICATION-ATTACK-JAVA.conf",
      "transforms": "",
      "troubleshooting": "",
      "rule_factory_type": 1,
      "description": "",
      "outside_references": "",
      "tuning_guidance_notes": "",
      "log_types": "",
      "severity": "",
      "http_protocol_phase": "",
      "false_positives": "",
      "original_rule": "SecRule TX:DETECTION_PARANOIA_LEVEL \"@lt 1\" \"id:944012,phase:2,pass,nolog,skipAfter:END-REQUEST-944-APPLICATION-ATTACK-JAVA\"",
      "name": "JAVA漏洞攻击防护规则-2",
      "http_status": "",
      "similar_rules": ""
    },
    {
      "level": 3,
      "app_name": "",
      "configuration_notes": "",
      "alert_message": "",
      "rule_class": "",
      "version": "",
      "action": "",
      "additional_information": "",
      "rule_id": 944100,
      "filename": "REQUEST-944-APPLICATION-ATTACK-JAVA.conf",
      "transforms": "",
      "troubleshooting": "",
      "rule_factory_type": 1,
      "description": "远程命令执行:检测到可疑的Java类",
      "outside_references": "",
      "tuning_guidance_notes": "",
      "log_types": "",
      "severity": "",
      "http_protocol_phase": "",
      "false_positives": "",
      "original_rule": "SecRule ARGS|ARGS_NAMES|REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|REQUEST_BODY|REQUEST_HEADERS|XML:/*|XML://@* \\\n    \"@rx java\\.lang\\.(?:runtime|processbuilder)\" \\\n    \"id:944100,\\\n    phase:2,\\\n    block,\\\n    t:none,t:lowercase,\\\n    msg:'Remote Command Execution: Suspicious Java class detected',\\\n    logdata:'Matched Data: %{MATCHED_VAR} found within %{MATCHED_VAR_NAME}',\\\n    tag:'application-multi',\\\n    tag:'language-java',\\\n    tag:'platform-multi',\\\n    tag:'attack-rce',\\\n    tag:'OWASP_CRS',\\\n    tag:'capec/1000/152/137/6',\\\n    tag:'PCI/6.5.2',\\\n    tag:'paranoia-level/1',\\\n    ver:'OWASP_CRS/4.0.0-rc2',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.rce_score=+%{tx.critical_anomaly_score}',\\\n    setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'\"",
      "name": "JAVA漏洞攻击防护规则-3",
      "http_status": "",
      "similar_rules": ""
    },
    {
      "level": 3,
      "app_name": "",
      "configuration_notes": "",
      "alert_message": "",
      "rule_class": "",
      "version": "",
      "action": "",
      "additional_information": "",
      "rule_id": 944110,
      "filename": "REQUEST-944-APPLICATION-ATTACK-JAVA.conf",
      "transforms": "",
      "troubleshooting": "",
      "rule_factory_type": 1,
      "description": "远程命令执行:Java进程生成漏洞(CVE-2017-9805)",
      "outside_references": "",
      "tuning_guidance_notes": "",
      "log_types": "",
      "severity": "",
      "http_protocol_phase": "",
      "false_positives": "",
      "original_rule": "SecRule ARGS|ARGS_NAMES|REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|REQUEST_BODY|REQUEST_HEADERS|XML:/*|XML://@* \\\n    \"@rx (?:runtime|processbuilder)\" \\\n    \"id:944110,\\\n    phase:2,\\\n    block,\\\n    t:none,t:lowercase,\\\n    msg:'Remote Command Execution: Java process spawn (CVE-2017-9805)',\\\n    logdata:'Matched Data: %{MATCHED_VAR} found within %{MATCHED_VAR_NAME}',\\\n    tag:'application-multi',\\\n    tag:'language-java',\\\n    tag:'platform-multi',\\\n    tag:'attack-rce',\\\n    tag:'OWASP_CRS',\\\n    tag:'capec/1000/152/248',\\\n    tag:'PCI/6.5.2',\\\n    tag:'paranoia-level/1',\\\n    ver:'OWASP_CRS/4.0.0-rc2',\\\n    severity:'CRITICAL',\\\n    chain\"\n    SecRule ARGS|ARGS_NAMES|REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|REQUEST_BODY|REQUEST_HEADERS|XML:/*|XML://@* \"@rx (?:unmarshaller|base64data|java\\.)\" \\\n        \"setvar:'tx.rce_score=+%{tx.critical_anomaly_score}',\\\n        setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'\"",
      "name": "JAVA漏洞攻击防护规则-4",
      "http_status": "",
      "similar_rules": ""
    },
    {
      "level": 3,
      "app_name": "",
      "configuration_notes": "",
      "alert_message": "",
      "rule_class": "",
      "version": "",
      "action": "",
      "additional_information": "",
      "rule_id": 944120,
      "filename": "REQUEST-944-APPLICATION-ATTACK-JAVA.conf",
      "transforms": "",
      "troubleshooting": "",
      "rule_factory_type": 1,
      "description": "远程命令执行:Java序列化漏洞(CVE-2015-4852)",
      "outside_references": "",
      "tuning_guidance_notes": "",
      "log_types": "",
      "severity": "",
      "http_protocol_phase": "",
      "false_positives": "",
      "original_rule": "SecRule ARGS|ARGS_NAMES|REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|REQUEST_BODY|REQUEST_HEADERS|XML:/*|XML://@* \\\n    \"@rx (?:clonetransformer|forclosure|instantiatefactory|instantiatetransformer|invokertransformer|prototypeclonefactory|prototypeserializationfactory|whileclosure|getproperty|filewriter|xmldecoder)\" \\\n    \"id:944120,\\\n    phase:2,\\\n    block,\\\n    t:none,t:lowercase,\\\n    msg:'Remote Command Execution: Java serialization (CVE-2015-4852)',\\\n    logdata:'Matched Data: %{MATCHED_VAR} found within %{MATCHED_VAR_NAME}',\\\n    tag:'application-multi',\\\n    tag:'language-java',\\\n    tag:'platform-multi',\\\n    tag:'attack-rce',\\\n    tag:'OWASP_CRS',\\\n    tag:'capec/1000/152/248',\\\n    tag:'PCI/6.5.2',\\\n    tag:'paranoia-level/1',\\\n    ver:'OWASP_CRS/4.0.0-rc2',\\\n    severity:'CRITICAL',\\\n    chain\"\n    SecRule MATCHED_VARS \"@rx (?:runtime|processbuilder)\" \\\n        \"setvar:'tx.rce_score=+%{tx.critical_anomaly_score}',\\\n        setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'\"",
      "name": "JAVA漏洞攻击防护规则-5",
      "http_status": "",
      "similar_rules": ""
    },
    {
      "level": 3,
      "app_name": "",
      "configuration_notes": "",
      "alert_message": "",
      "rule_class": "",
      "version": "",
      "action": "",
      "additional_information": "",
      "rule_id": 944130,
      "filename": "REQUEST-944-APPLICATION-ATTACK-JAVA.conf",
      "transforms": "",
      "troubleshooting": "",
      "rule_factory_type": 1,
      "description": "检测到可疑Java类",
      "outside_references": "",
      "tuning_guidance_notes": "",
      "log_types": "",
      "severity": "",
      "http_protocol_phase": "",
      "false_positives": "",
      "original_rule": "SecRule ARGS|ARGS_NAMES|REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|REQUEST_BODY|REQUEST_FILENAME|REQUEST_HEADERS|XML:/*|XML://@* \\\n    \"@pmFromFile ./waf_rules/java-classes.data\" \\\n    \"id:944130,\\\n    phase:2,\\\n    block,\\\n    t:none,\\\n    msg:'Suspicious Java class detected',\\\n    logdata:'Matched Data: %{MATCHED_VAR} found within %{MATCHED_VAR_NAME}',\\\n    tag:'application-multi',\\\n    tag:'language-java',\\\n    tag:'platform-multi',\\\n    tag:'attack-rce',\\\n    tag:'OWASP_CRS',\\\n    tag:'capec/1000/152/248',\\\n    tag:'PCI/6.5.2',\\\n    tag:'paranoia-level/1',\\\n    ver:'OWASP_CRS/4.0.0-rc2',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.rce_score=+%{tx.critical_anomaly_score}',\\\n    setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'\"",
      "name": "JAVA漏洞攻击防护规则-6",
      "http_status": "",
      "similar_rules": ""
    },
    {
      "level": 3,
      "app_name": "",
      "configuration_notes": "",
      "alert_message": "",
      "rule_class": "",
      "version": "",
      "action": "",
      "additional_information": "",
      "rule_id": 944140,
      "filename": "REQUEST-944-APPLICATION-ATTACK-JAVA.conf",
      "transforms": "",
      "troubleshooting": "",
      "rule_factory_type": 1,
      "description": "Java注入攻击:发现Java脚本文件上传",
      "outside_references": "",
      "tuning_guidance_notes": "",
      "log_types": "",
      "severity": "",
      "http_protocol_phase": "",
      "false_positives": "",
      "original_rule": "SecRule FILES|REQUEST_HEADERS:X-Filename|REQUEST_HEADERS:X_Filename|REQUEST_HEADERS:X.Filename|REQUEST_HEADERS:X-File-Name \"@rx .*\\.(?:jsp|jspx)\\.*$\" \"id:944140,phase:2,block,capture,t:none,t:lowercase,msg:'Java Injection Attack: Java Script File Upload Found',logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',tag:'application-multi',tag:'language-java',tag:'platform-multi',tag:'attack-injection-java',tag:'paranoia-level/1',tag:'OWASP_CRS',tag:'capec/1000/152/242',ver:'OWASP_CRS/4.0.0-rc2',severity:'CRITICAL',setvar:'tx.rce_score=+%{tx.critical_anomaly_score}',setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'\"",
      "name": "JAVA漏洞攻击防护规则-7",
      "http_status": "",
      "similar_rules": ""
    },
    {
      "level": 3,
      "app_name": "",
      "configuration_notes": "",
      "alert_message": "",
      "rule_class": "",
      "version": "",
      "action": "",
      "additional_information": "",
      "rule_id": 944150,
      "filename": "REQUEST-944-APPLICATION-ATTACK-JAVA.conf",
      "transforms": "",
      "troubleshooting": "",
      "rule_factory_type": 1,
      "description": "潜在的远程命令执行:Log4j / Log4shell",
      "outside_references": "",
      "tuning_guidance_notes": "",
      "log_types": "",
      "severity": "",
      "http_protocol_phase": "",
      "false_positives": "",
      "original_rule": "SecRule REQUEST_LINE|ARGS|ARGS_NAMES|REQUEST_COOKIES|REQUEST_COOKIES_NAMES|REQUEST_HEADERS|XML:/*|XML://@* \"@rx (?i)(?:\\$|&dollar;?)(?:\\{|&l(?:brace|cub);?)(?:[^\\}]{0,15}(?:\\$|&dollar;?)(?:\\{|&l(?:brace|cub);?)|jndi|ctx)\" \"id:944150,phase:2,block,t:none,t:urlDecodeUni,t:jsDecode,t:htmlEntityDecode,log,msg:'Potential Remote Command Execution: Log4j / Log4shell',tag:'application-multi',tag:'language-java',tag:'platform-multi',tag:'attack-rce',tag:'OWASP_CRS',tag:'capec/1000/152/137/6',tag:'PCI/6.5.2',tag:'paranoia-level/1',ver:'OWASP_CRS/4.0.0-rc2',severity:'CRITICAL',setvar:'tx.rce_score=+%{tx.critical_anomaly_score}',setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'\"",
      "name": "JAVA漏洞攻击防护规则-8",
      "http_status": "",
      "similar_rules": ""
    },
    {
      "level": 1,
      "app_name": "",
      "configuration_notes": "",
      "alert_message": "",
      "rule_class": "",
      "version": "",
      "action": "",
      "additional_information": "",
      "rule_id": 944013,
      "filename": "REQUEST-944-APPLICATION-ATTACK-JAVA.conf",
      "transforms": "",
      "troubleshooting": "",
      "rule_factory_type": 1,
      "description": "",
      "outside_references": "",
      "tuning_guidance_notes": "",
      "log_types": "",
      "severity": "",
      "http_protocol_phase": "",
      "false_positives": "",
      "original_rule": "SecRule TX:DETECTION_PARANOIA_LEVEL \"@lt 2\" \"id:944013,phase:1,pass,nolog,skipAfter:END-REQUEST-944-APPLICATION-ATTACK-JAVA\"",
      "name": "JAVA漏洞攻击防护规则-9",
      "http_status": "",
      "similar_rules": ""
    },
    {
      "level": 1,
      "app_name": "",
      "configuration_notes": "",
      "alert_message": "",
      "rule_class": "",
      "version": "",
      "action": "",
      "additional_information": "",
      "rule_id": 944014,
      "filename": "REQUEST-944-APPLICATION-ATTACK-JAVA.conf",
      "transforms": "",
      "troubleshooting": "",
      "rule_factory_type": 1,
      "description": "",
      "outside_references": "",
      "tuning_guidance_notes": "",
      "log_types": "",
      "severity": "",
      "http_protocol_phase": "",
      "false_positives": "",
      "original_rule": "SecRule TX:DETECTION_PARANOIA_LEVEL \"@lt 2\" \"id:944014,phase:2,pass,nolog,skipAfter:END-REQUEST-944-APPLICATION-ATTACK-JAVA\"",
      "name": "JAVA漏洞攻击防护规则-10",
      "http_status": "",
      "similar_rules": ""
    },
    {
      "level": 3,
      "app_name": "",
      "configuration_notes": "",
      "alert_message": "",
      "rule_class": "",
      "version": "",
      "action": "",
      "additional_information": "",
      "rule_id": 944151,
      "filename": "REQUEST-944-APPLICATION-ATTACK-JAVA.conf",
      "transforms": "",
      "troubleshooting": "",
      "rule_factory_type": 1,
      "description": "潜在的远程命令执行:Log4j / Log4shell",
      "outside_references": "",
      "tuning_guidance_notes": "",
      "log_types": "",
      "severity": "",
      "http_protocol_phase": "",
      "false_positives": "",
      "original_rule": "SecRule REQUEST_LINE|ARGS|ARGS_NAMES|REQUEST_COOKIES|REQUEST_COOKIES_NAMES|REQUEST_HEADERS|XML:/*|XML://@* \"@rx (?i)(?:\\$|&dollar;?)(?:\\{|&l(?:brace|cub);?)(?:[^\\}]*(?:\\$|&dollar;?)(?:\\{|&l(?:brace|cub);?)|jndi|ctx)\" \"id:944151,phase:2,block,t:none,t:urlDecodeUni,t:jsDecode,t:htmlEntityDecode,log,msg:'Potential Remote Command Execution: Log4j / Log4shell',tag:'application-multi',tag:'language-java',tag:'platform-multi',tag:'attack-rce',tag:'OWASP_CRS',tag:'capec/1000/152/137/6',tag:'PCI/6.5.2',tag:'paranoia-level/2',ver:'OWASP_CRS/4.0.0-rc2',severity:'CRITICAL',setvar:'tx.rce_score=+%{tx.critical_anomaly_score}',setvar:'tx.inbound_anomaly_score_pl2=+%{tx.critical_anomaly_score}'\"",
      "name": "JAVA漏洞攻击防护规则-11",
      "http_status": "",
      "similar_rules": ""
    },
    {
      "level": 3,
      "app_name": "",
      "configuration_notes": "",
      "alert_message": "",
      "rule_class": "",
      "version": "",
      "action": "",
      "additional_information": "",
      "rule_id": 944200,
      "filename": "REQUEST-944-APPLICATION-ATTACK-JAVA.conf",
      "transforms": "",
      "troubleshooting": "",
      "rule_factory_type": 1,
      "description": "检测到魔术字节，可能在使用java序列化",
      "outside_references": "",
      "tuning_guidance_notes": "",
      "log_types": "",
      "severity": "",
      "http_protocol_phase": "",
      "false_positives": "",
      "original_rule": "SecRule ARGS|ARGS_NAMES|REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|REQUEST_BODY|REQUEST_HEADERS|XML:/*|XML://@* \\\n    \"@rx \\xac\\xed\\x00\\x05\" \\\n    \"id:944200,\\\n    phase:2,\\\n    block,\\\n    msg:'Magic bytes Detected, probable java serialization in use',\\\n    logdata:'Matched Data: %{MATCHED_VAR} found within %{MATCHED_VAR_NAME}',\\\n    tag:'application-multi',\\\n    tag:'language-java',\\\n    tag:'platform-multi',\\\n    tag:'attack-rce',\\\n    tag:'OWASP_CRS',\\\n    tag:'capec/1000/152/248',\\\n    tag:'PCI/6.5.2',\\\n    tag:'paranoia-level/2',\\\n    ver:'OWASP_CRS/4.0.0-rc2',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.rce_score=+%{tx.critical_anomaly_score}',\\\n    setvar:'tx.inbound_anomaly_score_pl2=+%{tx.critical_anomaly_score}'\"",
      "name": "JAVA漏洞攻击防护规则-12",
      "http_status": "",
      "similar_rules": ""
    },
    {
      "level": 3,
      "app_name": "",
      "configuration_notes": "",
      "alert_message": "",
      "rule_class": "",
      "version": "",
      "action": "",
      "additional_information": "",
      "rule_id": 944210,
      "filename": "REQUEST-944-APPLICATION-ATTACK-JAVA.conf",
      "transforms": "",
      "troubleshooting": "",
      "rule_factory_type": 1,
      "description": "Magic bytes检测到Base64编码，可能在使用java序列化",
      "outside_references": "",
      "tuning_guidance_notes": "",
      "log_types": "",
      "severity": "",
      "http_protocol_phase": "",
      "false_positives": "",
      "original_rule": "SecRule ARGS|ARGS_NAMES|REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|REQUEST_BODY|REQUEST_HEADERS|XML:/*|XML://@* \\\n    \"@rx (?:rO0ABQ|KztAAU|Cs7QAF)\" \\\n    \"id:944210,\\\n    phase:2,\\\n    block,\\\n    msg:'Magic bytes Detected Base64 Encoded, probable java serialization in use',\\\n    logdata:'Matched Data: %{MATCHED_VAR} found within %{MATCHED_VAR_NAME}',\\\n    tag:'application-multi',\\\n    tag:'language-java',\\\n    tag:'platform-multi',\\\n    tag:'attack-rce',\\\n    tag:'OWASP_CRS',\\\n    tag:'capec/1000/152/248',\\\n    tag:'PCI/6.5.2',\\\n    tag:'paranoia-level/2',\\\n    ver:'OWASP_CRS/4.0.0-rc2',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.rce_score=+%{tx.critical_anomaly_score}',\\\n    setvar:'tx.inbound_anomaly_score_pl2=+%{tx.critical_anomaly_score}'\"",
      "name": "JAVA漏洞攻击防护规则-13",
      "http_status": "",
      "similar_rules": ""
    },
    {
      "level": 3,
      "app_name": "",
      "configuration_notes": "",
      "alert_message": "",
      "rule_class": "",
      "version": "",
      "action": "",
      "additional_information": "",
      "rule_id": 944240,
      "filename": "REQUEST-944-APPLICATION-ATTACK-JAVA.conf",
      "transforms": "",
      "troubleshooting": "",
      "rule_factory_type": 1,
      "description": "远程命令执行:Java序列化漏洞(CVE-2015-4852)",
      "outside_references": "",
      "tuning_guidance_notes": "",
      "log_types": "",
      "severity": "",
      "http_protocol_phase": "",
      "false_positives": "",
      "original_rule": "SecRule ARGS|ARGS_NAMES|REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|REQUEST_BODY|REQUEST_HEADERS|XML:/*|XML://@* \\\n    \"@rx (?:clonetransformer|forclosure|instantiatefactory|instantiatetransformer|invokertransformer|prototypeclonefactory|prototypeserializationfactory|whileclosure|getproperty|filewriter|xmldecoder)\" \\\n    \"id:944240,\\\n    phase:2,\\\n    block,\\\n    t:none,t:lowercase,\\\n    msg:'Remote Command Execution: Java serialization (CVE-2015-4852)',\\\n    logdata:'Matched Data: %{MATCHED_VAR} found within %{MATCHED_VAR_NAME}',\\\n    tag:'application-multi',\\\n    tag:'language-java',\\\n    tag:'platform-multi',\\\n    tag:'attack-rce',\\\n    tag:'OWASP_CRS',\\\n    tag:'capec/1000/152/248',\\\n    tag:'PCI/6.5.2',\\\n    tag:'paranoia-level/2',\\\n    ver:'OWASP_CRS/4.0.0-rc2',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.rce_score=+%{tx.critical_anomaly_score}',\\\n    setvar:'tx.inbound_anomaly_score_pl2=+%{tx.critical_anomaly_score}'\"",
      "name": "JAVA漏洞攻击防护规则-14",
      "http_status": "",
      "similar_rules": ""
    },
    {
      "level": 3,
      "app_name": "",
      "configuration_notes": "",
      "alert_message": "",
      "rule_class": "",
      "version": "",
      "action": "",
      "additional_information": "",
      "rule_id": 944250,
      "filename": "REQUEST-944-APPLICATION-ATTACK-JAVA.conf",
      "transforms": "",
      "troubleshooting": "",
      "rule_factory_type": 1,
      "description": "远程命令执行:检测到可疑的Java方法",
      "outside_references": "",
      "tuning_guidance_notes": "",
      "log_types": "",
      "severity": "",
      "http_protocol_phase": "",
      "false_positives": "",
      "original_rule": "SecRule ARGS|ARGS_NAMES|REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|REQUEST_BODY|REQUEST_HEADERS|XML:/*|XML://@* \\\n    \"@rx java\\b.+(?:runtime|processbuilder)\" \\\n    \"id:944250,\\\n    phase:2,\\\n    block,\\\n    t:lowercase,\\\n    msg:'Remote Command Execution: Suspicious Java method detected',\\\n    logdata:'Matched Data: %{MATCHED_VAR} found within %{MATCHED_VAR_NAME}',\\\n    tag:'application-multi',\\\n    tag:'language-java',\\\n    tag:'platform-multi',\\\n    tag:'attack-rce',\\\n    tag:'OWASP_CRS',\\\n    tag:'capec/1000/152/248',\\\n    tag:'PCI/6.5.2',\\\n    tag:'paranoia-level/2',\\\n    ver:'OWASP_CRS/4.0.0-rc2',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.rce_score=+%{tx.critical_anomaly_score}',\\\n    setvar:'tx.inbound_anomaly_score_pl2=+%{tx.critical_anomaly_score}'\"",
      "name": "JAVA漏洞攻击防护规则-15",
      "http_status": "",
      "similar_rules": ""
    },
    {
      "level": 3,
      "app_name": "",
      "configuration_notes": "",
      "alert_message": "",
      "rule_class": "",
      "version": "",
      "action": "",
      "additional_information": "",
      "rule_id": 944260,
      "filename": "REQUEST-944-APPLICATION-ATTACK-JAVA.conf",
      "transforms": "",
      "troubleshooting": "",
      "rule_factory_type": 1,
      "description": "远程命令执行:恶意类加载负载",
      "outside_references": "",
      "tuning_guidance_notes": "",
      "log_types": "",
      "severity": "",
      "http_protocol_phase": "",
      "false_positives": "",
      "original_rule": "SecRule ARGS|ARGS_NAMES|REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|REQUEST_BODY|REQUEST_HEADERS|XML:/*|XML://@* \\\n    \"@rx (?:class\\.module\\.classLoader\\.resources\\.context\\.parent\\.pipeline|springframework\\.context\\.support\\.FileSystemXmlApplicationContext)\" \\\n    \"id:944260,\\\n    phase:2,\\\n    block,\\\n    t:urlDecodeUni,\\\n    msg:'Remote Command Execution: Malicious class-loading payload',\\\n    logdata:'Matched Data: %{MATCHED_VAR} found within %{MATCHED_VAR_NAME}',\\\n    tag:'application-multi',\\\n    tag:'language-java',\\\n    tag:'platform-multi',\\\n    tag:'attack-rce',\\\n    tag:'OWASP_CRS',\\\n    tag:'capec/1000/152/248',\\\n    tag:'PCI/6.5.2',\\\n    tag:'paranoia-level/2',\\\n    ver:'OWASP_CRS/4.0.0-rc2',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.rce_score=+%{tx.critical_anomaly_score}',\\\n    setvar:'tx.inbound_anomaly_score_pl2=+%{tx.critical_anomaly_score}'\"",
      "name": "JAVA漏洞攻击防护规则-16",
      "http_status": "",
      "similar_rules": ""
    },
    {
      "level": 1,
      "app_name": "",
      "configuration_notes": "",
      "alert_message": "",
      "rule_class": "",
      "version": "",
      "action": "",
      "additional_information": "",
      "rule_id": 944015,
      "filename": "REQUEST-944-APPLICATION-ATTACK-JAVA.conf",
      "transforms": "",
      "troubleshooting": "",
      "rule_factory_type": 1,
      "description": "",
      "outside_references": "",
      "tuning_guidance_notes": "",
      "log_types": "",
      "severity": "",
      "http_protocol_phase": "",
      "false_positives": "",
      "original_rule": "SecRule TX:DETECTION_PARANOIA_LEVEL \"@lt 3\" \"id:944015,phase:1,pass,nolog,skipAfter:END-REQUEST-944-APPLICATION-ATTACK-JAVA\"",
      "name": "JAVA漏洞攻击防护规则-17",
      "http_status": "",
      "similar_rules": ""
    },
    {
      "level": 1,
      "app_name": "",
      "configuration_notes": "",
      "alert_message": "",
      "rule_class": "",
      "version": "",
      "action": "",
      "additional_information": "",
      "rule_id": 944016,
      "filename": "REQUEST-944-APPLICATION-ATTACK-JAVA.conf",
      "transforms": "",
      "troubleshooting": "",
      "rule_factory_type": 1,
      "description": "",
      "outside_references": "",
      "tuning_guidance_notes": "",
      "log_types": "",
      "severity": "",
      "http_protocol_phase": "",
      "false_positives": "",
      "original_rule": "SecRule TX:DETECTION_PARANOIA_LEVEL \"@lt 3\" \"id:944016,phase:2,pass,nolog,skipAfter:END-REQUEST-944-APPLICATION-ATTACK-JAVA\"",
      "name": "JAVA漏洞攻击防护规则-18",
      "http_status": "",
      "similar_rules": ""
    },
    {
      "level": 3,
      "app_name": "",
      "configuration_notes": "",
      "alert_message": "",
      "rule_class": "",
      "version": "",
      "action": "",
      "additional_information": "",
      "rule_id": 944300,
      "filename": "REQUEST-944-APPLICATION-ATTACK-JAVA.conf",
      "transforms": "",
      "troubleshooting": "",
      "rule_factory_type": 1,
      "description": "Base64编码字符串匹配可疑关键字",
      "outside_references": "",
      "tuning_guidance_notes": "",
      "log_types": "",
      "severity": "",
      "http_protocol_phase": "",
      "false_positives": "",
      "original_rule": "SecRule ARGS|ARGS_NAMES|REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|REQUEST_BODY|REQUEST_HEADERS|XML:/*|XML://@* \\\n    \"@rx (?:cnVudGltZQ|HJ1bnRpbWU|BydW50aW1l|cHJvY2Vzc2J1aWxkZXI|HByb2Nlc3NidWlsZGVy|Bwcm9jZXNzYnVpbGRlcg|Y2xvbmV0cmFuc2Zvcm1lcg|GNsb25ldHJhbnNmb3JtZXI|BjbG9uZXRyYW5zZm9ybWVy|Zm9yY2xvc3VyZQ|GZvcmNsb3N1cmU|Bmb3JjbG9zdXJl|aW5zdGFudGlhdGVmYWN0b3J5|Gluc3RhbnRpYXRlZmFjdG9yeQ|BpbnN0YW50aWF0ZWZhY3Rvcnk|aW5zdGFudGlhdGV0cmFuc2Zvcm1lcg|Gluc3RhbnRpYXRldHJhbnNmb3JtZXI|BpbnN0YW50aWF0ZXRyYW5zZm9ybWVy|aW52b2tlcnRyYW5zZm9ybWVy|Gludm9rZXJ0cmFuc2Zvcm1lcg|BpbnZva2VydHJhbnNmb3JtZXI|cHJvdG90eXBlY2xvbmVmYWN0b3J5|HByb3RvdHlwZWNsb25lZmFjdG9yeQ|Bwcm90b3R5cGVjbG9uZWZhY3Rvcnk|cHJvdG90eXBlc2VyaWFsaXphdGlvbmZhY3Rvcnk|HByb3RvdHlwZXNlcmlhbGl6YXRpb25mYWN0b3J5|Bwcm90b3R5cGVzZXJpYWxpemF0aW9uZmFjdG9yeQ|d2hpbGVjbG9zdXJl|HdoaWxlY2xvc3VyZQ|B3aGlsZWNsb3N1cmU)\" \\\n    \"id:944300,\\\n    phase:2,\\\n    block,\\\n    t:none,\\\n    msg:'Base64 encoded string matched suspicious keyword',\\\n    logdata:'Matched Data: %{MATCHED_VAR} found within %{MATCHED_VAR_NAME}',\\\n    tag:'application-multi',\\\n    tag:'language-java',\\\n    tag:'platform-multi',\\\n    tag:'attack-rce',\\\n    tag:'OWASP_CRS',\\\n    tag:'capec/1000/152/248',\\\n    tag:'PCI/6.5.2',\\\n    tag:'paranoia-level/3',\\\n    ver:'OWASP_CRS/4.0.0-rc2',\\\n    severity:'CRITICAL',\\\n    setvar:'tx.rce_score=+%{tx.critical_anomaly_score}',\\\n    setvar:'tx.inbound_anomaly_score_pl3=+%{tx.critical_anomaly_score}'\"",
      "name": "JAVA漏洞攻击防护规则-19",
      "http_status": "",
      "similar_rules": ""
    },
    {
      "level": 1,
      "app_name": "",
      "configuration_notes": "",
      "alert_message": "",
      "rule_class": "",
      "version": "",
      "action": "",
      "additional_information": "",
      "rule_id": 944017,
      "filename": "REQUEST-944-APPLICATION-ATTACK-JAVA.conf",
      "transforms": "",
      "troubleshooting": "",
      "rule_factory_type": 1,
      "description": "",
      "outside_references": "",
      "tuning_guidance_notes": "",
      "log_types": "",
      "severity": "",
      "http_protocol_phase": "",
      "false_positives": "",
      "original_rule": "SecRule TX:DETECTION_PARANOIA_LEVEL \"@lt 4\" \"id:944017,phase:1,pass,nolog,skipAfter:END-REQUEST-944-APPLICATION-ATTACK-JAVA\"",
      "name": "JAVA漏洞攻击防护规则-20",
      "http_status": "",
      "similar_rules": ""
    },
    {
      "level": 1,
      "app_name": "",
      "configuration_notes": "",
      "alert_message": "",
      "rule_class": "",
      "version": "",
      "action": "",
      "additional_information": "",
      "rule_id": 944018,
      "filename": "REQUEST-944-APPLICATION-ATTACK-JAVA.conf",
      "transforms": "",
      "troubleshooting": "",
      "rule_factory_type": 1,
      "description": "",
      "outside_references": "",
      "tuning_guidance_notes": "",
      "log_types": "",
      "severity": "",
      "http_protocol_phase": "",
      "false_positives": "",
      "original_rule": "SecRule TX:DETECTION_PARANOIA_LEVEL \"@lt 4\" \"id:944018,phase:2,pass,nolog,skipAfter:END-REQUEST-944-APPLICATION-ATTACK-JAVA\"",
      "name": "JAVA漏洞攻击防护规则-21",
      "http_status": "",
      "similar_rules": ""
    },
    {
      "level": 3,
      "app_name": "",
      "configuration_notes": "",
      "alert_message": "",
      "rule_class": "",
      "version": "",
      "action": "",
      "additional_information": "",
      "rule_id": 944152,
      "filename": "REQUEST-944-APPLICATION-ATTACK-JAVA.conf",
      "transforms": "",
      "troubleshooting": "",
      "rule_factory_type": 1,
      "description": "潜在的远程命令执行:Log4j / Log4shell",
      "outside_references": "",
      "tuning_guidance_notes": "",
      "log_types": "",
      "severity": "",
      "http_protocol_phase": "",
      "false_positives": "",
      "original_rule": "SecRule REQUEST_LINE|ARGS|ARGS_NAMES|REQUEST_COOKIES|REQUEST_COOKIES_NAMES|REQUEST_HEADERS|XML:/*|XML://@* \"@rx (?i)(?:\\$|&dollar;?)(?:\\{|&l(?:brace|cub);?)\" \"id:944152,phase:2,block,t:none,t:urlDecodeUni,t:jsDecode,t:htmlEntityDecode,log,msg:'Potential Remote Command Execution: Log4j / Log4shell',tag:'application-multi',tag:'language-java',tag:'platform-multi',tag:'attack-rce',tag:'OWASP_CRS',tag:'capec/1000/152/137/6',tag:'PCI/6.5.2',tag:'paranoia-level/4',ver:'OWASP_CRS/4.0.0-rc2',severity:'CRITICAL',setvar:'tx.rce_score=+%{tx.critical_anomaly_score}',setvar:'tx.inbound_anomaly_score_pl4=+%{tx.critical_anomaly_score}'\"",
      "name": "JAVA漏洞攻击防护规则-22",
      "http_status": "",
      "similar_rules": ""
    }
  ]
}