AI SOC Daily Security Report

{
  "action": "block",
  "description": "SOC-RULE-001a Block NetCup AS48090 scraping of homepage",
  "enabled": true,
  "expression": "(ip.src eq 93.123.109.15) or (ip.src.asnum eq 48090 and http.request.uri.path eq \"/\")",
  "action_parameters": {
    "response": { "status_code": 403, "content_type": "text/plain", "content": "Blocked: abusive scraping" }
  }
}

{
  "action": "managed_challenge",
  "description": "SOC-RULE-001b Rate limit hot pages for unverified clients",
  "enabled": true,
  "expression": "(http.request.uri.path in {\"/\" \"/sitemap.xml\" \"/robots.txt\"} and http.request.method eq \"GET\" and not cf.client.bot)",
  "ratelimit": {
    "characteristics": ["ip.src", "cf.colo.id"],
    "period": 60,
    "requests_per_period": 60,
    "mitigation_timeout": 600,
    "requests_to_origin": false
  }
}

{
  "action": "block",
  "description": "SOC-RULE-002a Rate limit wp-login.php POST",
  "enabled": true,
  "expression": "(http.request.uri.path eq \"/wp-login.php\" and http.request.method eq \"POST\")",
  "ratelimit": {
    "characteristics": ["ip.src"],
    "period": 60,
    "requests_per_period": 3,
    "mitigation_timeout": 3600,
    "requests_to_origin": false
  }
}

{
  "action": "managed_challenge",
  "description": "SOC-RULE-002b Challenge wp-login.php GET",
  "enabled": true,
  "expression": "(http.request.uri.path eq \"/wp-login.php\" and http.request.method eq \"GET\")"
}

{
  "action": "block",
  "description": "SOC-RULE-003 Block .env / .git / backup file probes",
  "enabled": true,
  "expression": "(lower(http.request.uri.path) matches \"(^|/)\\\\.(env|git|svn|hg|aws|ssh|vscode|idea|ds_store)(/|$|\\\\.)\" or lower(http.request.uri.path) matches \"\\\\.(bak|backup|old|orig|swp|swo|save|tmp)$\" or ends_with(lower(http.request.uri.path), \"~\") or lower(http.request.uri.path) matches \"/(api|app|backend|admin|core|public|src|dev|prod|staging|test)/\\\\.env\" or lower(http.request.uri.path) matches \"/(wp-config|configuration|database|settings|config)\\\\.(php|inc|yml|yaml|json|js)\\\\.(bak|old|orig|swp|save)$\")"
}

{
  "action": "block",
  "description": "SOC-RULE-004a Block ALFA/known PHP webshell paths",
  "enabled": true,
  "expression": "(lower(http.request.uri.path) matches \"(alfa_data|alfacgiapi|\\\\.alfa|/r57|/c99|/wso|/b374k|/lite_shell|/wp_filemanager|/marijuana|/indoxploit|/anonghost|/priv8|/0byt3m1n1|/madspot)\" or lower(http.request.uri.path) matches \"/(shell|backdoor|cmd|exec|webshell|adminer)\\\\.(php|phtml|phar)$\" or lower(http.request.uri.path) eq \"/phpmyadmin/scripts/setup.php\")"
}

{
  "action": "block",
  "description": "SOC-RULE-004b Deny PHP/CGI execution under upload dirs",
  "enabled": true,
  "expression": "(lower(http.request.uri.path) matches \"/(wp-content/uploads|uploads|files|media|images|cache|tmp)/.*\\\\.(php|phar|phtml|php3|php5|php7|pht|inc|cgi|pl|py|sh|asp|aspx|jsp)$\")"
}

{
  "action": "block",
  "description": "SOC-RULE-005 Block known vulnerable WP plugin/theme PHP paths",
  "enabled": true,
  "expression": "(lower(http.request.uri.path) matches \"/wp-content/(themes|plugins)/(seotheme|hellopress|easy-wp-smtp|wp-file-manager|file-manager-advanced|essential-addons-for-elementor-lite|duplicator|wpdiscuz|ultimate-member)/\" and lower(http.request.uri.path) matches \"\\\\.(php|phar|phtml)$\")"
}

{
  "action": "block",
  "description": "SOC-RULE-006a Block xmlrpc.php entirely",
  "enabled": true,
  "expression": "(http.request.uri.path eq \"/xmlrpc.php\")"
}

{
  "action": "managed_challenge",
  "description": "SOC-RULE-007 Challenge cloud-hosted IPs hitting WordPress",
  "enabled": true,
  "expression": "(ip.src.asnum in {8075 14618 16509 396982 48090 16276 24940 63949 14061 20473} and (starts_with(http.request.uri.path, \"/wp-\") or http.request.uri.path eq \"/xmlrpc.php\"))"
}

{
  "action": "managed_challenge",
  "description": "SOC-RULE-008 Challenge high-risk geos hitting WP admin",
  "enabled": true,
  "expression": "(ip.src.country in {\"NL\" \"VN\" \"LK\" \"TR\" \"BG\" \"RU\" \"IR\" \"KP\" \"CN\" \"BY\"} and (starts_with(http.request.uri.path, \"/wp-admin\") or starts_with(http.request.uri.path, \"/wp-login\") or starts_with(http.request.uri.path, \"/wp-includes\") or http.request.uri.path eq \"/xmlrpc.php\"))"
}

{
  "action": "block",
  "description": "SOC-RULE-009a Block unused/typo subdomains",
  "enabled": true,
  "expression": "(http.host in {\"contorller.tek-safari.com\" \"cpcontacts.tek-safari.com\" \"autodiscover.tek-safari.com\" \"webdisk.tek-safari.com\" \"blog.blog.tek-safari.com\" \"demo.hostmaster.tek-safari.com\"})"
}