# Web probes against shanemccausland.com
# Classifies requests for paths that do not exist on this site. Anything asking for these paths is a scanner, not a visitor. Dotfile probes such as /.env are blocked by the CDN firewall before they reach this logger.
# Source of truth for the live feed on the homepage.

author: Shane McCausland
rules:
  - id: robots_tripwire
    title: robots.txt tripwire: a path that only exists as bait in robots.txt
    attack: T1594
    level: high
    pattern: '(^|/)internal-backup(/|$)'

  - id: secret_file_probe
    title: Secret or credential file probe
    attack: T1552.001
    level: high
    pattern: '(^|/)\.(env|aws|npmrc|pgpass|htpasswd|ssh)|wp-config|/config\.(json|ya?ml|php|js)$|credentials|secrets?\.(json|ya?ml)|id_rsa'

  - id: vcs_exposure
    title: Exposed source control probe
    attack: T1213
    level: high
    pattern: '(^|/)\.(git|svn|hg|bzr)(/|$)'

  - id: exploit_attempt
    title: Known exploit path
    attack: T1190
    level: high
    pattern: '\.\./|%2e%2e|/etc/passwd|/proc/self|/cgi-bin/|eval-stdin\.php|/vendor/phpunit|/actuator|/boaform|/hnap1|/solr/|/console|/shell|/cmd|/goform|/setup\.cgi|/druid|/geoserver|/owa/'

  - id: injection_probe
    title: Script or SQL injection probe
    attack: T1190
    level: high
    pattern: '<script|%3cscript|javascript:|union(\s|%20|\+)+select|''(\s|%20)*or(\s|%20)+''?1|%27'

  - id: wordpress_recon
    title: WordPress recon on a non-WordPress site
    attack: T1595.003
    level: medium
    pattern: '(^|/)(wp-login\.php|wp-admin|xmlrpc\.php|wp-content|wp-includes|wp-json|wordpress)'

  - id: admin_panel_hunt
    title: Admin panel hunt
    attack: T1595.003
    level: medium
    pattern: 'phpmyadmin|/pma(/|$)|adminer|/admin(/|$|\.php)|/administrator|/manager/html|/cpanel|/webmail|/login\.php'

  - id: backup_hunt
    title: Backup or dump file hunt
    attack: T1595.003
    level: medium
    pattern: '\.(bak|old|orig|sql|sql\.gz|zip|tar|tar\.gz|tgz|7z|rar|swp)$|/backup|/dump'

  - id: php_probe
    title: PHP file probe on a mostly static site
    attack: T1595.002
    level: low
    pattern: '\.php$'