Preconfigured rules
Google Cloud Armor preconfigured rules are complex web application firewall (WAF) rules with dozens of signatures that are compiled from open source industry standards. Google offers these rules as-is. The rules enable Google Cloud Armor to evaluate dozens of distinct traffic signatures by referring to conveniently-named rules, rather than requiring you to define each signature manually.
The following table contains a comprehensive list of preconfigured WAF rules that are available for use in a Google Cloud Armor security policy. The rule source is ModSecurity Core Rule Set 3.0.2.
| Google Cloud Armor rule name | ModSecurity rule name | Current Status |
|---|---|---|
| sqli-stable | SQL injection | In sync with sqli-canary |
| sqli-canary | SQL injection | Latest |
| xss-stable | Cross-site scripting | In sync with xss-canary |
| xss-canary | Cross-site scripting | Latest |
| lfi-stable (Beta) | Local file inclusion | In sync with lfi-canary |
| lfi-canary (Beta) | Local file inclusion | Latest |
| rfi-stable (Beta) | Remote file inclusion | In sync with rfi-canary |
| rfi-canary (Beta) | Remote file inclusion | Latest |
| rce-stable (Beta) | Remote code execution | In sync with rce-canary |
| rce-canary (Beta) | Remote code execution | Latest |
About rule tuning
Each preconfigured rule consists of multiple signatures. Incoming requests are
evaluated against the preconfigured rules. A request matches a preconfigured
rule if the request matches any of the signatures that are associated with the
preconfigured rule. A match is made when the evaluatePreconfiguredExpr()
command returns the value true.
If you decide that a preconfigured rule matches more traffic than is necessary
or if the rule is blocking traffic that needs to be allowed, the rule can be
tuned to disable noisy or otherwise unnecessary signatures. To disable signatures
in a particular preconfigured rule, you provide a list of IDs of the unwanted
signatures to the evaluatePreconfiguredExpr() command. For example, here is
an example match condition in the rules language with a tuned rule:
evaluatePreconfiguredExpr('xss-stable', ['owasp-crs-v020901-id981136-xss', 'owasp-crs-v020901-id981138-xss'])
Preconfigured ModSecurity rules
SQL injection
| Signature ID (CRS Rule ID) | Sensitivity Level | Description |
|---|---|---|
| owasp-crs-v030001-id942140-sqli | 1 | SQL Injection Attack: Common DB Names Detected |
| owasp-crs-v030001-id942160-sqli | 1 | Detects blind sqli tests using sleep() or benchmark(). |
| owasp-crs-v030001-id942170-sqli | 1 | Detects SQL benchmark and sleep injection attempts including conditional queries |
| owasp-crs-v030001-id942190-sqli | 1 | Detects MSSQL code execution and information gathering attempts |
| owasp-crs-v030001-id942220-sqli | 1 | Looking for integer overflow attacks |
| owasp-crs-v030001-id942230-sqli | 1 | Detects conditional SQL injection attempts |
| owasp-crs-v030001-id942240-sqli | 1 | Detects MySQL charset switch and MSSQL DoS attempts |
| owasp-crs-v030001-id942250-sqli | 1 | Detects MATCH AGAINST |
| owasp-crs-v030001-id942270-sqli | 1 | Looking for basic sql injection. Common attack string for mysql |
| owasp-crs-v030001-id942280-sqli | 1 | Detects Postgres pg_sleep injection |
| owasp-crs-v030001-id942290-sqli | 1 | Finds basic MongoDB SQL injection attempts |
| owasp-crs-v030001-id942320-sqli | 1 | Detects MySQL and PostgreSQL stored procedure/function injections |
| owasp-crs-v030001-id942350-sqli | 1 | Detects MySQL UDF injection and other data/structure manipulation attempts |
| owasp-crs-v030001-id942360-sqli | 1 | Detects concatenated basic SQL injection and SQLLFI attempts |
| owasp-crs-v030001-id942110-sqli | 2 | SQL Injection Attack: Common Injection Testing Detected |
| owasp-crs-v030001-id942120-sqli | 2 | SQL Injection Attack: SQL Operator Detected |
| owasp-crs-v030001-id942150-sqli | 2 | SQL Injection Attack |
| owasp-crs-v030001-id942180-sqli | 2 | Detects basic SQL authentication bypass attempts 1/3 |
| owasp-crs-v030001-id942200-sqli | 2 | Detects MySQL comment-/space-obfuscated injections and backtick termination |
| owasp-crs-v030001-id942210-sqli | 2 | Detects chained SQL injection attempts 1/2 |
| owasp-crs-v030001-id942260-sqli | 2 | Detects basic SQL authentication bypass attempts 2/3 |
| owasp-crs-v030001-id942300-sqli | 2 | Detects MySQL comments |
| owasp-crs-v030001-id942310-sqli | 2 | Detects chained SQL injection attempts 2/2 |
| owasp-crs-v030001-id942330-sqli | 2 | Detects classic SQL injection probings 1/2 |
| owasp-crs-v030001-id942340-sqli | 2 | Detects basic SQL authentication bypass attempts 3/3 |
| owasp-crs-v030001-id942380-sqli | 2 | SQL Injection Attack |
| owasp-crs-v030001-id942390-sqli | 2 | SQL Injection Attack |
| owasp-crs-v030001-id942400-sqli | 2 | SQL Injection Attack |
| owasp-crs-v030001-id942410-sqli | 2 | SQL Injection Attack |
| owasp-crs-v030001-id942430-sqli | 2 | Restricted SQL Character Anomaly Detection (args): # of special characters exceeded (12) |
| owasp-crs-v030001-id942440-sqli | 2 | SQL Comment Sequence Detected. |
| owasp-crs-v030001-id942450-sqli | 2 | SQL Hex Encoding Identified |
| owasp-crs-v030001-id942251-sqli | 3 | Detects HAVING injections |
| owasp-crs-v030001-id942420-sqli | 3 | Restricted SQL Character Anomaly Detection (cookies): # of special characters exceeded (8) |
| owasp-crs-v030001-id942431-sqli | 3 | Restricted SQL Character Anomaly Detection (args): # of special characters exceeded (6) |
| owasp-crs-v030001-id942460-sqli | 3 | Meta-Character Anomaly Detection Alert - Repetitive Non-Word Characters |
| owasp-crs-v030001-id942421-sqli | 4 | Restricted SQL Character Anomaly Detection (cookies): # of special characters exceeded (3) |
| owasp-crs-v030001-id942432-sqli | 4 | Restricted SQL Character Anomaly Detection (args): # of special characters exceeded (2) |
To configure a rule at a particular sensitivity level, disable the signatures at greater sensitivity levels:
| SQLi Sensitivity Level 1 |
|---|
evaluatePreconfiguredExpr('sqli-stable', ['owasp-crs-v030001-id942110-sqli',
'owasp-crs-v030001-id942120-sqli',
'owasp-crs-v030001-id942150-sqli',
'owasp-crs-v030001-id942180-sqli',
'owasp-crs-v030001-id942200-sqli',
'owasp-crs-v030001-id942210-sqli',
'owasp-crs-v030001-id942260-sqli',
'owasp-crs-v030001-id942300-sqli',
'owasp-crs-v030001-id942310-sqli',
'owasp-crs-v030001-id942330-sqli',
'owasp-crs-v030001-id942340-sqli',
'owasp-crs-v030001-id942380-sqli',
'owasp-crs-v030001-id942390-sqli',
'owasp-crs-v030001-id942400-sqli',
'owasp-crs-v030001-id942410-sqli',
'owasp-crs-v030001-id942430-sqli',
'owasp-crs-v030001-id942440-sqli',
'owasp-crs-v030001-id942450-sqli',
'owasp-crs-v030001-id942251-sqli',
'owasp-crs-v030001-id942420-sqli',
'owasp-crs-v030001-id942431-sqli',
'owasp-crs-v030001-id942460-sqli',
'owasp-crs-v030001-id942421-sqli',
'owasp-crs-v030001-id942432-sqli']
)
|
| SQLi Sensitivity Level 2 |
|---|
evaluatePreconfiguredExpr('sqli-stable', ['owasp-crs-v030001-id942251-sqli',
'owasp-crs-v030001-id942420-sqli',
'owasp-crs-v030001-id942431-sqli',
'owasp-crs-v030001-id942460-sqli',
'owasp-crs-v030001-id942421-sqli',
'owasp-crs-v030001-id942432-sqli']
)
|
| SQLi Sensitivity Level 3 |
|---|
evaluatePreconfiguredExpr('sqli-stable', ['owasp-crs-v030001-id942421-sqli',
'owasp-crs-v030001-id942432-sqli']
)
|
| SQLi Sensitivity Level 4 |
|---|
evaluatePreconfiguredExpr('sqli-stable')
|
Cross-Site Scripting (XSS)
| Signature ID (Rule ID) | Sensitivity Level | Description |
|---|---|---|
| owasp-crs-v030001-id941110-xss | 1 | XSS Filter - Category 1: Script Tag Vector |
| owasp-crs-v030001-id941120-xss | 1 | XSS Filter - Category 2: Event Handler Vector |
| owasp-crs-v030001-id941130-xss | 1 | XSS Filter - Category 3: Attribute Vector |
| owasp-crs-v030001-id941140-xss | 1 | XSS Filter - Category 4: JavaScript URI Vector |
| owasp-crs-v030001-id941160-xss | 1 | NoScript XSS InjectionChecker: HTML Injection |
| owasp-crs-v030001-id941170-xss | 1 | NoScript XSS InjectionChecker: Attribute Injection |
| owasp-crs-v030001-id941180-xss | 1 | Node-Validator Blacklist Keywords |
| owasp-crs-v030001-id941190-xss | 1 | IE XSS Filters - Attack Detected. |
| owasp-crs-v030001-id941200-xss | 1 | IE XSS Filters - Attack Detected. |
| owasp-crs-v030001-id941210-xss | 1 | IE XSS Filters - Attack Detected. |
| owasp-crs-v030001-id941220-xss | 1 | IE XSS Filters - Attack Detected. |
| owasp-crs-v030001-id941230-xss | 1 | IE XSS Filters - Attack Detected. |
| owasp-crs-v030001-id941240-xss | 1 | IE XSS Filters - Attack Detected. |
| owasp-crs-v030001-id941250-xss | 1 | IE XSS Filters - Attack Detected. |
| owasp-crs-v030001-id941260-xss | 1 | IE XSS Filters - Attack Detected. |
| owasp-crs-v030001-id941270-xss | 1 | IE XSS Filters - Attack Detected. |
| owasp-crs-v030001-id941280-xss | 1 | IE XSS Filters - Attack Detected. |
| owasp-crs-v030001-id941290-xss | 1 | IE XSS Filters - Attack Detected. |
| owasp-crs-v030001-id941300-xss | 1 | IE XSS Filters - Attack Detected. |
| owasp-crs-v030001-id941310-xss | 1 | US-ASCII Malformed Encoding XSS Filter - Attack Detected. |
| owasp-crs-v030001-id941350-xss | 1 | UTF-7 Encoding IE XSS - Attack Detected. |
| owasp-crs-v030001-id941150-xss | 2 | XSS Filter - Category 5: Disallowed HTML Attributes |
| owasp-crs-v030001-id941320-xss | 2 | Possible XSS Attack Detected - HTML Tag Handler |
| owasp-crs-v030001-id941330-xss | 2 | IE XSS Filters - Attack Detected. |
| owasp-crs-v030001-id941340-xss | 2 | IE XSS Filters - Attack Detected. |
To configure a rule at a particular sensitivity level, disable the signatures at greater sensitivity levels:
| XSS Sensitivity Level 1 |
|---|
evaluatePreconfiguredExpr('xss-stable', ['owasp-crs-v030001-id941150-xss',
'owasp-crs-v030001-id941320-xss',
'owasp-crs-v030001-id941330-xss',
'owasp-crs-v030001-id941340-xss'])
|
All signatures for XSS are below sensitivity level 2. The following configuration works for other sensitivity levels:
| XSS Sensitivity Level 2/3/4 |
|---|
evaluatePreconfiguredExpr('xss-stable')
|
Local file inclusion (LFI) (beta)
| Signature ID (Rule ID) | Sensitivity Level | Description |
|---|---|---|
| owasp-crs-v030001-id930100-lfi | 1 | Path Traversal Attack (/../) |
| owasp-crs-v030001-id930110-lfi | 1 | Path Traversal Attack (/../) |
| owasp-crs-v030001-id930120-lfi | 1 | OS File Access Attempt |
| owasp-crs-v030001-id930130-lfi | 1 | Restricted File Access Attempt |
All signatures for LFI are at sensitivity level 1. The following configuration works for all sensitivity levels:
| LFI Sensitivity Levels 1/2/3/4 |
|---|
evaluatePreconfiguredExpr('lfi-canary')
|
Remote Code Execution (RCE)
| Signature ID (Rule ID) | Sensitivity Level | Description |
|---|---|---|
| owasp-crs-v030001-id932100-rce | 1 | UNIX Command Injection |
| owasp-crs-v030001-id932105-rce | 1 | UNIX Command Injection |
| owasp-crs-v030001-id932110-rce | 1 | Windows Command Injection |
| owasp-crs-v030001-id932115-rce | 1 | Windows Command Injection |
| owasp-crs-v030001-id932120-rce | 1 | Windows PowerShell Command Found |
| owasp-crs-v030001-id932130-rce | 1 | Unix Shell Expression Found |
| owasp-crs-v030001-id932140-rce | 1 | Windows FOR/IF Command Found |
| owasp-crs-v030001-id932150-rce | 1 | Direct UNIX Command Execution |
| owasp-crs-v030001-id932160-rce | 1 | UNIX Shell Code Found |
| owasp-crs-v030001-id932170-rce | 1 | Shellshock (CVE-2014-6271) |
| owasp-crs-v030001-id932171-rce | 1 | Shellshock (CVE-2014-6271) |
All signatures for RCE are at sensitivity level 1. The following configuration works for all sensitivity levels:
| RCE Sensitivity Levels 1/2/3/4 |
|---|
evaluatePreconfiguredExpr('rce-canary')
|
Remote File Inclusion (RFI)
| Signature ID (Rule ID) | Sensitivity Level | Description |
|---|---|---|
| owasp-crs-v030001-id931100-rfi | 1 | URL Parameter using IP Address |
| owasp-crs-v030001-id931110-rfi | 1 | Common RFI Vulnerable Parameter Name used w/URL Payload |
| owasp-crs-v030001-id931120-rfi | 1 | URL Payload Used w/Trailing Question Mark Character (?) |
| owasp-crs-v030001-id931130-rfi | 2 | Off-Domain Reference/Link |
To configure a rule at a particular sensitivity level, disable the signatures at greater sensitivity levels:
| RFI Sensitivity Level 1 |
|---|
evaluatePreconfiguredExpr('rfi-canary', ['owasp-crs-v030001-id931130-rfi'])
|
| RFI Sensitivity Level 2/3/4 |
|---|
evaluatePreconfiguredExpr('rfi-canary')
|
What's next
- To configure security policies, rules, and expressions, use the instructions in Configuring security policies and Creating Google Cloud Armor security policies, rules, and expressions.