coreruleset · fzipi · Dec 11, 2022 · Dec 11, 2022 · Dec 11, 2022
diff --git a/regex-assembly/932125.ra b/regex-assembly/932125.ra
@@ -3,6 +3,8 @@
 
 ##! Word list for rule 932125 (RCE Windows command injection - PowerShell aliases)
 ##!
+##! This list comes from the powershell source code. Can be updated using this oneliner:
+##! curl -s https://raw.githubusercontent.com/PowerShell/PowerShell/master/src/System.Management.Automation/engine/InitialSessionState.cs -o - | awk -F\" '/new SessionStateAliasEntry\("/ { print $2; }'
 ##! To prevent some FP for a command, you can require command parameters
 ##! after a command. Only do this if the command regularly causes FP and if
 ##! allowing the bare command (without parameters) is not too dangerous.
@@ -86,21 +88,28 @@
 
     ac@
     asnp@
+    cd@
     ##! disabled for FP: cat@
     chdir@
     clc@
+    ##! disabled for FP: clear
     clhy@
     cli@
     clp@
+    cls
     clv@
+    cnsn
     ##! disabled for FP: compare@
     ##! disabled for FP: copy@
+    cp@
     cpi@
     cpp@
     cvpa@
     dbp@
     del@
+    diff@
     dir@
+    dnsn
     ebp@
     epal@
     epcsv@
@@ -120,6 +129,7 @@
     gcm@
     gcs@
     gdr@
+    gerr
     ghy@
     gi@
     gjb@
@@ -128,13 +138,15 @@
     gmo@
     gp@
     gps@
+    gpv
     ##! disabled for FP: group
     gsn@
     gsnp@
     gsv@
     gu@
     gv@
     gwmi@
+    ##! disabled for FP: h
     ##! disabled for FP: history
     icm@
     iex@
@@ -144,39 +156,50 @@
     ipcsv@
     ipmo@
     ipsn@
+    irm@
+    ise@
     iwmi@
     iwr@
     ##! disabled for FP: kill
-    lp@
+    ls
+    man@
+    md@
     ##! disabled for FP: measure
     mi@
+    mount@
     ##! disabled for FP: move
     mp@
+    mv@
     nal@
     ndr@
     ni@
     nmo@
+    npssc
     nsn@
     nv@
     ogv@
     ##! disabled for FP: oh
     popd@
     pushd@
     ##! disabled for FP: pwd
+    ##! disabled for FP: r
     rbp@
     rcjb@
+    rcsn
     rd@
     rdr@
     ren@
     ri@
     rjb@
+    rm@
     rmdir@
     rmo@
     rni@
     rnp@
     rp@
     rsn@
     rsnp@
+    rujb
     rv@
     rvpa@
     rwmi@
@@ -188,16 +211,21 @@
     sc@
     ##! disabled for FP: select
     ##! disabled for FP: set
+    shcm
     si@
     sl@
+    ##! disabled for FP: sleep
     sls@
+    ##! disabled for FP: sort
     sp@
     spjb@
     spps@
     spsv@
     ##! disabled for FP: start
+    sujb
     sv@
     swmi@
+    ##! disabled for FP: tee
     trcm@
     ##! disabled for FP: type
     ##! disabled for FP: where

diff --git a/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf b/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf
@@ -296,7 +296,7 @@ SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAME
 # (consult https://coreruleset.org/docs/development/regex_assembly/ for details):
 #   crs-toolchain regex update 932125
 #
-SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/* "@rx (?i)(?:[\n\r;`\{]|\|\|?|&&?)[\s\v]*[\s\v\"'-\(,@]*(?:[\"'\.-9A-Z_a-z]+/|(?:[\"'\x5c\^]*[0-9A-Z_a-z][\"'\x5c\^]*:.*|[ \"'\.-9A-Z\x5c\^-_a-z]*)\x5c)?[\"\^]*(?:(?:a[\"\^]*(?:c|s[\"\^]*n[\"\^]*p)|c[\"\^]*(?:h[\"\^]*d[\"\^]*i[\"\^]*r|l[\"\^]*(?:[cipv]|h[\"\^]*y)|p[\"\^]*[ip]|v[\"\^]*p[\"\^]*a)|d[\"\^]*(?:b[\"\^]*p|e[\"\^]*l|i[\"\^]*r)|e[\"\^]*(?:b[\"\^]*p|p[\"\^]*(?:a[\"\^]*l|c[\"\^]*s[\"\^]*v|s[\"\^]*n)|[tx][\"\^]*s[\"\^]*n)|f[\"\^]*(?:[cltw]|o[\"\^]*r[\"\^]*e[\"\^]*a[\"\^]*c[\"\^]*h)|i[\"\^]*(?:c[\"\^]*m|e[\"\^]*x|h[\"\^]*y|i|p[\"\^]*(?:a[\"\^]*l|c[\"\^]*s[\"\^]*v|m[\"\^]*o|s[\"\^]*n)|w[\"\^]*(?:m[\"\^]*i|r))|l[\"\^]*p|m[\"\^]*[ip]|n[\"\^]*(?:a[\"\^]*l|d[\"\^]*r|[iv]|m[\"\^]*o|s[\"\^]*n)|o[\"\^]*g[\"\^]*v|p[\"\^]*(?:o[\"\^]*p|u[\"\^]*s[\"\^]*h)[\"\^]*d|t[\"\^]*r[\"\^]*c[\"\^]*m|w[\"\^]*j[\"\^]*b)[\"\^]*|g[\"\^]*(?:(?:(?:a[\"\^]*)?l|b[\"\^]*p|d[\"\^]*r|h[\"\^]*y|(?:w[\"\^]*m[\"\^]*)?i|j[\"\^]*b|[u-v])[\"\^]*|c[\"\^]*(?:[ims][\"\^]*)?|m[\"\^]*(?:o[\"\^]*)?|p[\"\^]*(?:s[\"\^]*)?|s[\"\^]*(?:n[\"\^]*(?:p[\"\^]*)?|v[\"\^]*))|r[\"\^]*(?:(?:(?:b[\"\^]*)?p|(?:c[\"\^]*)?j[\"\^]*b|e[\"\^]*n|(?:w[\"\^]*m[\"\^]*)?i|m[\"\^]*(?:d[\"\^]*i[\"\^]*r|o)|n[\"\^]*[ip])[\"\^]*|d[\"\^]*(?:r[\"\^]*)?|s[\"\^]*n[\"\^]*(?:p[\"\^]*)?|v[\"\^]*(?:p[\"\^]*a[\"\^]*)?)|s[\"\^]*(?:(?:a[\"\^]*(?:j[\"\^]*b|l|p[\"\^]*s|s[\"\^]*v)|b[\"\^]*p|[civ]|w[\"\^]*m[\"\^]*i)[\"\^]*|l[\"\^]*(?:s[\"\^]*)?|p[\"\^]*(?:(?:j[\"\^]*b|p[\"\^]*s|s[\"\^]*v)[\"\^]*)?))[\s\v,\.-/;-<>].*(?:\.[\"\^]*[0-9A-Z_a-z]+)?\b" \
+SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/* "@rx (?i)(?:[\n\r;`\{]|\|\|?|&&?)[\s\v]*[\s\v\"'-\(,@]*(?:[\"'\.-9A-Z_a-z]+/|(?:[\"'\x5c\^]*[0-9A-Z_a-z][\"'\x5c\^]*:.*|[ \"'\.-9A-Z\x5c\^-_a-z]*)\x5c)?[\"\^]*(?:(?:a[\"\^]*(?:c|s[\"\^]*n[\"\^]*p)|e[\"\^]*(?:b[\"\^]*p|p[\"\^]*(?:a[\"\^]*l|c[\"\^]*s[\"\^]*v|s[\"\^]*n)|[tx][\"\^]*s[\"\^]*n)|f[\"\^]*(?:[cltw]|o[\"\^]*r[\"\^]*e[\"\^]*a[\"\^]*c[\"\^]*h)|i[\"\^]*(?:[cr][\"\^]*m|e[\"\^]*x|h[\"\^]*y|i|p[\"\^]*(?:a[\"\^]*l|c[\"\^]*s[\"\^]*v|m[\"\^]*o|s[\"\^]*n)|s[\"\^]*e|w[\"\^]*(?:m[\"\^]*i|r))|m[\"\^]*(?:a[\"\^]*n|[dipv]|o[\"\^]*u[\"\^]*n[\"\^]*t)|o[\"\^]*g[\"\^]*v|p[\"\^]*(?:o[\"\^]*p|u[\"\^]*s[\"\^]*h)[\"\^]*d|t[\"\^]*r[\"\^]*c[\"\^]*m|w[\"\^]*j[\"\^]*b)[\"\^]*[\s\v,\.-/;-<>].*|c[\"\^]*(?:(?:(?:d|h[\"\^]*d[\"\^]*i[\"\^]*r|v[\"\^]*p[\"\^]*a)[\"\^]*|p[\"\^]*(?:[ip][\"\^]*)?)[\s\v,\.-/;-<>].*|l[\"\^]*(?:(?:[cipv]|h[\"\^]*y)[\"\^]*[\s\v,\.-/;-<>].*|s)|n[\"\^]*s[\"\^]*n)|d[\"\^]*(?:(?:b[\"\^]*p|e[\"\^]*l|i[\"\^]*(?:f[\"\^]*f|r))[\"\^]*[\s\v,\.-/;-<>].*|n[\"\^]*s[\"\^]*n)|g[\"\^]*(?:(?:(?:(?:a[\"\^]*)?l|b[\"\^]*p|d[\"\^]*r|h[\"\^]*y|(?:w[\"\^]*m[\"\^]*)?i|j[\"\^]*b|[u-v])[\"\^]*|c[\"\^]*(?:[ims][\"\^]*)?|m[\"\^]*(?:o[\"\^]*)?|s[\"\^]*(?:n[\"\^]*(?:p[\"\^]*)?|v[\"\^]*))[\s\v,\.-/;-<>].*|e[\"\^]*r[\"\^]*r|p[\"\^]*(?:(?:s[\"\^]*)?[\s\v,\.-/;-<>].*|v))|l[\"\^]*s|n[\"\^]*(?:(?:a[\"\^]*l|d[\"\^]*r|[iv]|m[\"\^]*o|s[\"\^]*n)[\"\^]*[\s\v,\.-/;-<>].*|p[\"\^]*s[\"\^]*s[\"\^]*c)|r[\"\^]*(?:(?:(?:(?:b[\"\^]*)?p|e[\"\^]*n|(?:w[\"\^]*m[\"\^]*)?i|j[\"\^]*b|n[\"\^]*[ip])[\"\^]*|d[\"\^]*(?:r[\"\^]*)?|m[\"\^]*(?:(?:d[\"\^]*i[\"\^]*r|o)[\"\^]*)?|s[\"\^]*n[\"\^]*(?:p[\"\^]*)?|v[\"\^]*(?:p[\"\^]*a[\"\^]*)?)[\s\v,\.-/;-<>].*|c[\"\^]*(?:j[\"\^]*b[\"\^]*[\s\v,\.-/;-<>].*|s[\"\^]*n)|u[\"\^]*j[\"\^]*b)|s[\"\^]*(?:(?:(?:a[\"\^]*(?:j[\"\^]*b|l|p[\"\^]*s|s[\"\^]*v)|b[\"\^]*p|[civ]|w[\"\^]*m[\"\^]*i)[\"\^]*|l[\"\^]*(?:s[\"\^]*)?|p[\"\^]*(?:(?:j[\"\^]*b|p[\"\^]*s|s[\"\^]*v)[\"\^]*)?)[\s\v,\.-/;-<>].*|h[\"\^]*c[\"\^]*m|u[\"\^]*j[\"\^]*b))(?:\.[\"\^]*[0-9A-Z_a-z]+)?\b" \
     "id:932125,\
     phase:2,\
     block,\