Web Application Defender's Cookbook

Recipe 13-1: Tracking Anomaly Scores

This recipe shows you how to utilize anomaly scoring to track suspicious behavior across multiple requests.

Ingredients

• ModSecurity
  • TX:ANOMALY_SCORE variable
  • IP:ANOMALY_SCORE variable
  • SESSION:ANOMALY_SCORE variable
  • @gt operator
  • @ge operator
  • @lt operator
  • setvar action
  • initcol action
  • setsid action

Per-Transaction Anomaly Scores

Many detection recipes in Part II showed examples of using transactional anomaly scores. This is done by using the ModSecurity setvar action to increment the anomaly_score variable in the transient TX collection. Here is an example taken from the modsecurity_crs_41_sql_injection.conf file:

# # -=[ SQL Tautologies ]=- # SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/| REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/* \ "(?i:([\s'\"'´''\(\)]*)([\d\w]++)([\s'\"'´''\(\)]*)(?:(?:=|<=>|r?lik e|sounds\s+like|regexp)([\s'\"'´''\(\)]*)\2|(?:!=|<=|>=|<>|<|>|\^|is \s+not|not\s+like|not\s+regexp)([\s'\"'´''\(\)]*)(?!\2)([\d\w]+)))"\ "phase:2,rev:'2',ver:'OWASP_CRS/2.2.6',maturity:'9',accuracy :'8',capture,multiMatch,t:none,t:urlDecodeUni,t:replaceComments, ctl:auditLogParts=+E,block,msg:'SQL Injection Attack',id:'950901', logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',severity:'2', tag:'OWASP_CRS/WEB_ATTACK/SQL_INJECTION', tag:'WASCTC/WASC-19',tag:'OWASP_TOP_10/A1', tag:'OWASP_AppSensor/CIE1', tag:'PCI/6.5.2',setvar:'tx.msg=%{rule.msg}', setvar:tx.sql_injection_score=+%{tx.critical_anomaly_score}, ...