Skip to content

Commit 26d2dd8

Browse files
JamesJBarnettJamesJBarnett
authored
Merge pull request #212272 from vhorne/waf-drs2.1
Start drs 2.1 content
2 parents 51f87ea + 36a52ab commit 26d2dd8

File tree

1 file changed

+322
-1
lines changed

1 file changed

+322
-1
lines changed

‎articles/web-application-firewall/afds/waf-front-door-drs.md

Lines changed: 322 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@ ms.service: web-application-firewall
55
author: vhorne
66
ms.author: victorh
77
ms.topic: conceptual
8-
ms.date: 10/05/2022
8+
ms.date: 10/25/2022
99
---
1010

1111
# Web Application Firewall DRS rule groups and rules
@@ -61,6 +61,53 @@ When your WAF uses older version of the default rule set (before DRS 2.0), your
6161

6262
The version of the DRS that you use also determines which content types are supported for request body inspection. For more information, see [What content types does WAF support?](waf-faq.yml#what-content-types-does-waf-support-) in the FAQ.
6363

64+
### DRS 2.1
65+
66+
DRS 2.1 rules offer better protection than earlier versions of the DRS. It includes additional rules developed by the Microsoft Threat Intelligence team and updates to signatures to reduce false positives. It also supports transformations beyond just URL decoding.
67+
68+
DRS 2.1 includes 17 rule groups, as shown in the following table. Each group contains multiple rules, and you can customize behavior for individual rules, rule groups, or entire rule set. For more information, see [Tuning Web Application Firewall (WAF) for Azure Front Door](waf-front-door-tuning.md).
69+
70+
71+
72+
> [!NOTE]
73+
> DRS 2.1 is only available on Azure Front Door Premium.
74+
75+
|Rule group|Description|
76+
|---|---|
77+
|**[General](#general-21)**|General group|
78+
|**[METHOD-ENFORCEMENT](#drs911-21)**|Lock-down methods (PUT, PATCH)|
79+
|**[PROTOCOL-ENFORCEMENT](#drs920-21)**|Protect against protocol and encoding issues|
80+
|**[PROTOCOL-ATTACK](#drs921-21)**|Protect against header injection, request smuggling, and response splitting|
81+
|**[APPLICATION-ATTACK-LFI](#drs930-21)**|Protect against file and path attacks|
82+
|**[APPLICATION-ATTACK-RFI](#drs931-21)**|Protect against remote file inclusion (RFI) attacks|
83+
|**[APPLICATION-ATTACK-RCE](#drs932-21)**|Protect again remote code execution attacks|
84+
|**[APPLICATION-ATTACK-PHP](#drs933-21)**|Protect against PHP-injection attacks|
85+
|**[APPLICATION-ATTACK-NodeJS](#drs934-21)**|Protect against Node JS attacks|
86+
|**[APPLICATION-ATTACK-XSS](#drs941-21)**|Protect against cross-site scripting attacks|
87+
|**[APPLICATION-ATTACK-SQLI](#drs942-21)**|Protect against SQL-injection attacks|
88+
|**[APPLICATION-ATTACK-SESSION-FIXATION](#drs943-21)**|Protect against session-fixation attacks|
89+
|**[APPLICATION-ATTACK-SESSION-JAVA](#drs944-21)**|Protect against JAVA attacks|
90+
|**[MS-ThreatIntel-WebShells](#drs9905-21)**|Protect against Web shell attacks|
91+
|**[MS-ThreatIntel-AppSec](#drs9903-21)**|Protect against AppSec attacks|
92+
|**[MS-ThreatIntel-SQLI](#drs99031-21)**|Protect against SQLI attacks|
93+
|**[MS-ThreatIntel-CVEs](#drs99001-21)**|Protect against CVE attacks|
94+
95+
#### Disabled rules
96+
97+
The following rules are disabled by default for DRS 2.1:
98+
99+
|Rule ID |Rule Group|Description |Why disabled|
100+
|---------|---------|---------|---------|
101+
|942110 |SQLI|SQL Injection Attack: Common Injection Testing Detected |Replaced by MSTIC rule 99031001 |
102+
|942150 |SQLI|SQL Injection Attack|Replaced by MSTIC rule 99031003 |
103+
|942260 |SQLI|Detects basic SQL authentication bypass attempts 2/3 |Replaced by MSTIC rule 99031004 |
104+
|942430 |SQLI|Restricted SQL Character Anomaly Detection (args): # of special characters exceeded (12)|Too many false positives.|
105+
|942440 |SQLI|SQL Comment Sequence Detected|Replaced by MSTIC rule 99031002 |
106+
|99005006|MS-ThreatIntel-WebShells|Spring4Shell Interaction Attempt|Replaced by Microsoft threat intelligence rule.|
107+
|99001014|MS-ThreatIntel-CVEs|Attempted Spring Cloud routing-expression injection [CVE-2022-22963](https://www.cve.org/CVERecord?id=CVE-2022-22963)|Replaced by Microsoft threat intelligence rule.|
108+
|99001015|MS-ThreatIntel-WebShells|Attempted Spring Framework unsafe class object exploitation [CVE-2022-22965](https://www.cve.org/CVERecord?id=CVE-2022-22965)|Replaced by Microsoft threat intelligence rule.|
109+
|99001016|MS-ThreatIntel-WebShells|Attempted Spring Cloud Gateway Actuator injection [CVE-2022-22947](https://www.cve.org/CVERecord?id=CVE-2022-22947)|Replaced by Microsoft threat intelligence rule.|
110+
64111
### DRS 2.0
65112

66113
DRS 2.0 rules offer better protection than earlier versions of the DRS. It also supports transformations beyond just URL decoding.
@@ -133,6 +180,280 @@ DRS 2.0 includes 17 rule groups, as shown in the following table. Each group con
133180

134181
The following rule groups and rules are available when using Web Application Firewall on Azure Front Door.
135182

183+
# [DRS 2.1](#tab/drs21)
184+
185+
## <a name="drs21"></a> 2.1 rule sets
186+
187+
### <a name="general-21"></a> General
188+
|RuleId|Description|
189+
|---|---|
190+
|200002|Failed to parse request body.|
191+
|200003|Multipart request body failed strict validation|
192+
193+
194+
### <a name="drs911-21"></a> METHOD ENFORCEMENT
195+
|RuleId|Description|
196+
|---|---|
197+
|911100|Method is not allowed by policy|
198+
199+
### <a name="drs920-21"></a> PROTOCOL-ENFORCEMENT
200+
|RuleId|Description|
201+
|---|---|
202+
|920100|Invalid HTTP Request Line|
203+
|920120|Attempted multipart/form-data bypass|
204+
|920121|Attempted multipart/form-data bypass|
205+
|920160|Content-Length HTTP header is not numeric.|
206+
|920170|GET or HEAD Request with Body Content.|
207+
|920171|GET or HEAD Request with Transfer-Encoding.|
208+
|920180|POST request missing Content-Length Header.|
209+
|920181|Content-Length and Transfer-Encoding headers present 99001003|
210+
|920190|Range: Invalid Last Byte Value.|
211+
|920200|Range: Too many fields (6 or more)|
212+
|920201|Range: Too many fields for pdf request (35 or more)|
213+
|920210|Multiple/Conflicting Connection Header Data Found.|
214+
|920220|URL Encoding Abuse Attack Attempt|
215+
|920230|Multiple URL Encoding Detected|
216+
|920240|URL Encoding Abuse Attack Attempt|
217+
|920260|Unicode Full/Half Width Abuse Attack Attempt|
218+
|920270|Invalid character in request (null character)|
219+
|920271|Invalid character in request (non printable characters)|
220+
|920280|Request Missing a Host Header|
221+
|920290|Empty Host Header|
222+
|920300|Request Missing an Accept Header|
223+
|920310|Request Has an Empty Accept Header|
224+
|920311|Request Has an Empty Accept Header|
225+
|920320|Missing User Agent Header|
226+
|920330|Empty User Agent Header|
227+
|920340|Request Containing Content, but Missing Content-Type header|
228+
|920341|Request containing content requires Content-Type header|
229+
|920350|Host header is a numeric IP address|
230+
|920420|Request content type is not allowed by policy|
231+
|920430|HTTP protocol version is not allowed by policy|
232+
|920440|URL file extension is restricted by policy|
233+
|920450|HTTP header is restricted by policy|
234+
|920470|Illegal Content-Type header|
235+
|920480|Request content type charset is not allowed by policy|
236+
|920500|Attempt to access a backup or working file|
237+
238+
### <a name="drs921-21"></a> PROTOCOL-ATTACK
239+
240+
|RuleId|Description|
241+
|---|---|
242+
|921110|HTTP Request Smuggling Attack|
243+
|921120|HTTP Response Splitting Attack|
244+
|921130|HTTP Response Splitting Attack|
245+
|921140|HTTP Header Injection Attack via headers|
246+
|921150|HTTP Header Injection Attack via payload (CR/LF detected)|
247+
|921151|HTTP Header Injection Attack via payload (CR/LF detected)|
248+
|921160|HTTP Header Injection Attack via payload (CR/LF and header-name detected)|
249+
|921190|HTTP Splitting (CR/LF in request filename detected)|
250+
|921200|LDAP Injection Attack|
251+
252+
253+
### <a name="drs930-21"></a> LFI - Local File Inclusion
254+
|RuleId|Description|
255+
|---|---|
256+
|930100|Path Traversal Attack (/../)|
257+
|930110|Path Traversal Attack (/../)|
258+
|930120|OS File Access Attempt|
259+
|930130|Restricted File Access Attempt|
260+
261+
### <a name="drs931-21"></a> RFI - Remote File Inclusion
262+
|RuleId|Description|
263+
|---|---|
264+
|931100|Possible Remote File Inclusion (RFI) Attack: URL Parameter using IP Address|
265+
|931110|Possible Remote File Inclusion (RFI) Attack: Common RFI Vulnerable Parameter Name used w/URL Payload|
266+
|931120|Possible Remote File Inclusion (RFI) Attack: URL Payload Used w/Trailing Question Mark Character (?)|
267+
|931130|Possible Remote File Inclusion (RFI) Attack: Off-Domain Reference/Link|
268+
269+
### <a name="drs932-21"></a> RCE - Remote Command Execution
270+
|RuleId|Description|
271+
|---|---|
272+
|932100|Remote Command Execution: Unix Command Injection|
273+
|932105|Remote Command Execution: Unix Command Injection|
274+
|932110|Remote Command Execution: Windows Command Injection|
275+
|932115|Remote Command Execution: Windows Command Injection|
276+
|932120|Remote Command Execution: Windows PowerShell Command Found|
277+
|932130|Remote Command Execution: Unix Shell Expression or Confluence Vulnerability (CVE-2022-26134) Found|
278+
|932140|Remote Command Execution: Windows FOR/IF Command Found|
279+
|932150|Remote Command Execution: Direct Unix Command Execution|
280+
|932160|Remote Command Execution: Unix Shell Code Found|
281+
|932170|Remote Command Execution: Shellshock (CVE-2014-6271)|
282+
|932171|Remote Command Execution: Shellshock (CVE-2014-6271)|
283+
|932180|Restricted File Upload Attempt|
284+
285+
### <a name="drs933-21"></a> PHP Attacks
286+
|RuleId|Description|
287+
|---|---|
288+
|933100|PHP Injection Attack: Opening/Closing Tag Found|
289+
|933110|PHP Injection Attack: PHP Script File Upload Found|
290+
|933120|PHP Injection Attack: Configuration Directive Found|
291+
|933130|PHP Injection Attack: Variables Found|
292+
|933140|PHP Injection Attack: I/O Stream Found|
293+
|933150|PHP Injection Attack: High-Risk PHP Function Name Found|
294+
|933151|PHP Injection Attack: Medium-Risk PHP Function Name Found|
295+
|933160|PHP Injection Attack: High-Risk PHP Function Call Found|
296+
|933170|PHP Injection Attack: Serialized Object Injection|
297+
|933180|PHP Injection Attack: Variable Function Call Found|
298+
|933200|PHP Injection Attack: Wrapper scheme detected|
299+
|933210|PHP Injection Attack: Variable Function Call Found|
300+
301+
### <a name="drs934-21"></a> Node JS Attacks
302+
|RuleId|Description|
303+
|---|---|
304+
|934100|Node.js Injection Attack|
305+
306+
### <a name="drs941-21"></a> XSS - Cross-site Scripting
307+
|RuleId|Description|
308+
|---|---|
309+
|941100|XSS Attack Detected via libinjection|
310+
|941101|XSS Attack Detected via libinjection.<br />This rule detects requests with a *Referer* header.|
311+
|941110|XSS Filter - Category 1: Script Tag Vector|
312+
|941120|XSS Filter - Category 2: Event Handler Vector|
313+
|941130|XSS Filter - Category 3: Attribute Vector|
314+
|941140|XSS Filter - Category 4: JavaScript URI Vector|
315+
|941150|XSS Filter - Category 5: Disallowed HTML Attributes|
316+
|941160|NoScript XSS InjectionChecker: HTML Injection|
317+
|941170|NoScript XSS InjectionChecker: Attribute Injection|
318+
|941180|Node-Validator Blacklist Keywords|
319+
|941190|XSS Using style sheets|
320+
|941200|XSS using VML frames|
321+
|941210|XSS using obfuscated JavaScript|
322+
|941220|XSS using obfuscated VB Script|
323+
|941230|XSS using 'embed' tag|
324+
|941240|XSS using 'import' or 'implementation' attribute|
325+
|941250|IE XSS Filters - Attack Detected.|
326+
|941260|XSS using 'meta' tag|
327+
|941270|XSS using 'link' href|
328+
|941280|XSS using 'base' tag|
329+
|941290|XSS using 'applet' tag|
330+
|941300|XSS using 'object' tag|
331+
|941310|US-ASCII Malformed Encoding XSS Filter - Attack Detected.|
332+
|941320|Possible XSS Attack Detected - HTML Tag Handler|
333+
|941330|IE XSS Filters - Attack Detected.|
334+
|941340|IE XSS Filters - Attack Detected.|
335+
|941350|UTF-7 Encoding IE XSS - Attack Detected.|
336+
|941360|JavaScript obfuscation detected.|
337+
|941370|JavaScript global variable found|
338+
|941380|AngularJS client side template injection detected|
339+
340+
>[!NOTE]
341+
> This article contains references to the term *blacklist*, a term that Microsoft no longer uses. When the term is removed from the software, we’ll remove it from this article.
342+
343+
### <a name="drs942-21"></a> SQLI - SQL Injection
344+
|RuleId|Description|
345+
|---|---|
346+
|942100|SQL Injection Attack Detected via libinjection|
347+
|942110|SQL Injection Attack: Common Injection Testing Detected|
348+
|942120|SQL Injection Attack: SQL Operator Detected|
349+
|942140|SQL Injection Attack: Common DB Names Detected|
350+
|942150|SQL Injection Attack|
351+
|942160|Detects blind sqli tests using sleep() or benchmark().|
352+
|942170|Detects SQL benchmark and sleep injection attempts including conditional queries|
353+
|942180|Detects basic SQL authentication bypass attempts 1/3|
354+
|942190|Detects MSSQL code execution and information gathering attempts|
355+
|942200|Detects MySQL comment-/space-obfuscated injections and backtick termination|
356+
|942210|Detects chained SQL injection attempts 1/2|
357+
|942220|Looking for integer overflow attacks, these are taken from skipfish, except 3.0.00738585072007e-308 is the "magic number" crash|
358+
|942230|Detects conditional SQL injection attempts|
359+
|942240|Detects MySQL charset switch and MSSQL DoS attempts|
360+
|942250|Detects MATCH AGAINST, MERGE and EXECUTE IMMEDIATE injections|
361+
|942260|Detects basic SQL authentication bypass attempts 2/3|
362+
|942270|Looking for basic sql injection. Common attack string for mysql, oracle, and others.|
363+
|942280|Detects Postgres pg_sleep injection, waitfor delay attacks and database shutdown attempts|
364+
|942290|Finds basic MongoDB SQL injection attempts|
365+
|942300|Detects MySQL comments, conditions, and ch(a)r injections|
366+
|942310|Detects chained SQL injection attempts 2/2|
367+
|942320|Detects MySQL and PostgreSQL stored procedure/function injections|
368+
|942330|Detects classic SQL injection probings 1/2|
369+
|942340|Detects basic SQL authentication bypass attempts 3/3|
370+
|942350|Detects MySQL UDF injection and other data/structure manipulation attempts|
371+
|942360|Detects concatenated basic SQL injection and SQLLFI attempts|
372+
|942361|Detects basic SQL injection based on keyword alter or union|
373+
|942370|Detects classic SQL injection probings 2/2|
374+
|942380|SQL Injection Attack|
375+
|942390|SQL Injection Attack|
376+
|942400|SQL Injection Attack|
377+
|942410|SQL Injection Attack|
378+
|942430|Restricted SQL Character Anomaly Detection (args): # of special characters exceeded (12)|
379+
|942440|SQL Comment Sequence Detected|
380+
|942450|SQL Hex Encoding Identified|
381+
|942460|Meta-Character Anomaly Detection Alert - Repetitive Non-Word Characters|
382+
|942470|SQL Injection Attack|
383+
|942480|SQL Injection Attack|
384+
|942500|MySQL in-line comment detected.|
385+
|942510|SQLi bypass attempt by ticks or backticks detected.|
386+
387+
### <a name="drs943-21"></a> SESSION-FIXATION
388+
|RuleId|Description|
389+
|---|---|
390+
|943100|Possible Session Fixation Attack: Setting Cookie Values in HTML|
391+
|943110|Possible Session Fixation Attack: SessionID Parameter Name with Off-Domain Referrer|
392+
|943120|Possible Session Fixation Attack: SessionID Parameter Name with No Referrer|
393+
394+
### <a name="drs944-21"></a> JAVA Attacks
395+
|RuleId|Description|
396+
|---|---|
397+
|944100|Remote Command Execution: Apache Struts, Oracle WebLogic|
398+
|944110|Detects potential payload execution|
399+
|944120|Possible payload execution and remote command execution|
400+
|944130|Suspicious Java classes|
401+
|944200|Exploitation of Java deserialization Apache Commons|
402+
|944210|Possible use of Java serialization|
403+
|944240|Remote Command Execution: Java serialization and Log4j vulnerability ([CVE-2021-44228](https://www.cve.org/CVERecord?id=CVE-2021-44228), [CVE-2021-45046](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-45046))|
404+
|944250|Remote Command Execution: Suspicious Java method detected|
405+
406+
### <a name="drs9905-21"></a> MS-ThreatIntel-WebShells
407+
|RuleId|Description|
408+
|---|---|
409+
|99005002|Web Shell Interaction Attempt (POST)|
410+
|99005003|Web Shell Upload Attempt (POST) - CHOPPER PHP|
411+
|99005004|Web Shell Upload Attempt (POST) - CHOPPER ASPX|
412+
|99005005|Web Shell Interaction Attempt|
413+
|99005006|Spring4Shell Interaction Attempt|
414+
415+
### <a name="drs9903-21"></a> MS-ThreatIntel-AppSec
416+
|RuleId|Description|
417+
|---|---|
418+
|99030001|Path Traversal Evasion in Headers (/.././../)|
419+
|99030002|Path Traversal Evasion in Request Body (/.././../)|
420+
421+
### <a name="drs99031-21"></a> MS-ThreatIntel-SQLI
422+
|RuleId|Description|
423+
|---|---|
424+
|99031001|SQL Injection Attack: Common Injection Testing Detected|
425+
|99031002|SQL Comment Sequence Detected.|
426+
|99031003|SQL Injection Attack|
427+
|99031004|Detects basic SQL authentication bypass attempts 2/3|
428+
429+
### <a name="drs99001-21"></a> MS-ThreatIntel-CVEs
430+
|RuleId|Description|
431+
|---|---|
432+
|99001001|Attempted F5 tmui (CVE-2020-5902) REST API Exploitation with known credentials|
433+
|99001002|Attempted Citrix NSC_USER directory traversal [CVE-2019-19781](https://www.cve.org/CVERecord?id=CVE-2019-19781)|
434+
|99001003|Attempted Atlassian Confluence Widget Connector exploitation [CVE-2019-3396](https://www.cve.org/CVERecord?id=CVE-2019-3396)|
435+
|99001004|Attempted Pulse Secure custom template exploitation [CVE-2020-8243](https://www.cve.org/CVERecord?id=CVE-2019-8243)|
436+
|99001005|Attempted SharePoint type converter exploitation [CVE-2020-0932](https://www.cve.org/CVERecord?id=CVE-2019-0932)|
437+
|99001006|Attempted Pulse Connect directory traversal [CVE-2019-11510](https://www.cve.org/CVERecord?id=CVE-2019-11510)|
438+
|99001007|Attempted Junos OS J-Web local file inclusion [CVE-2020-1631](https://www.cve.org/CVERecord?id=CVE-2019-1631)|
439+
|99001008|Attempted Fortinet path traversal [CVE-2018-13379](https://www.cve.org/CVERecord?id=CVE-2019-13379)|
440+
|99001009|Attempted Apache struts ognl injection [CVE-2017-5638](https://www.cve.org/CVERecord?id=CVE-2019-5638)|
441+
|99001010|Attempted Apache struts ognl injection [CVE-2017-12611](https://www.cve.org/CVERecord?id=CVE-2019-12611)|
442+
|99001011|Attempted Oracle WebLogic path traversal [CVE-2020-14882](https://www.cve.org/CVERecord?id=CVE-2019-14882)|
443+
|99001012|Attempted Telerik WebUI insecure deserialization exploitation [CVE-2019-18935](https://www.cve.org/CVERecord?id=CVE-2019-18935)|
444+
|99001013|Attempted SharePoint insecure XML deserialization [CVE-2019-0604](https://www.cve.org/CVERecord?id=CVE-2019-0604)|
445+
|99001014|Attempted Spring Cloud routing-expression injection [CVE-2022-22963](https://www.cve.org/CVERecord?id=CVE-2022-22963)|
446+
|99001015|Attempted Spring Framework unsafe class object exploitation [CVE-2022-22965](https://www.cve.org/CVERecord?id=CVE-2022-22965)|
447+
|99001016|Attempted Spring Cloud Gateway Actuator injection [CVE-2022-22947](https://www.cve.org/CVERecord?id=CVE-2022-22947)|
448+
449+
> [!NOTE]
450+
> When reviewing your WAF's logs, you might see rule ID 949110. The description of the rule might include *Inbound Anomaly Score Exceeded*.
451+
>
452+
> This rule indicates that the total anomaly score for the request exceeded the maximum allowable score. For more information, see [Anomaly scoring](#anomaly-scoring-mode).
453+
>
454+
> When you tune your WAF policies, you need to investigate the other rules that were triggered by the request so that you can adjust your WAF's configuration. For more information, see [Tuning Web Application Firewall (WAF) for Azure Front Door](waf-front-door-tuning.md).
455+
456+
136457
# [DRS 2.0](#tab/drs20)
137458

138459
## <a name="drs20"></a> 2.0 rule sets

0 commit comments

Comments
 (0)