8000 feat: detect ASP web shells by Xhoenix · Pull Request #4063 · coreruleset/coreruleset · GitHub
[go: up one dir, main page]
More Web Proxy on the site http://driver.im/
Skip to content

feat: detect ASP web shells #4063

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 7 commits into from
Apr 1, 2025
Merged

Conversation

Xhoenix
Copy link
Member
@Xhoenix Xhoenix commented Mar 30, 2025

Copy link
Contributor
github-actions bot commented Mar 30, 2025

📊 Quantitative test results for language: eng, year: 2023, size: 10K, paranoia level: 1:
🚀 Quantitative testing did not detect new false positives

@azurit
Copy link
Member
azurit commented Mar 30, 2025

Let's create rule similar to 955100 with it's own file for @pmFromFile for ASP web shells. I have two more ASP shells.

@Xhoenix Xhoenix changed the title feat: added new aspx web shell feat: detect asp web shells Mar 30, 2025
@Xhoenix Xhoenix changed the title feat: detect asp web shells feat: detect ASP web shells Mar 30, 2025
@fzipi
Copy link
Member
fzipi commented Mar 31, 2025

Can you also add tests, now that we are adding a new rule id?

@Xhoenix
Copy link
Member Author
Xhoenix commented Apr 1, 2025

Waiting for @azurit to add the other two ASP shells he mentioned, after that I'll add the tests.

@azurit
Copy link
Member
azurit commented Apr 1, 2025

@Xhoenix Done.

@Xhoenix
Copy link
Member Author
Xhoenix commented Apr 1, 2025

LGTM 😊

Copy link
Member
@fzipi fzipi left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Nice team work! 🙌

@fzipi fzipi added the release:new-detection In this PR we introduce a new detection label Apr 1, 2025
@Xhoenix Xhoenix added this pull request to the merge queue Apr 1, 2025
Merged via the queue into coreruleset:main with commit 6da0d75 Apr 1, 2025
6 checks passed
@Xhoenix Xhoenix deleted the add-new-aspx-webshell branch April 1, 2025 12:20
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
release:new-detection In this PR we introduce a new detection
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants
0