coreruleset · franbuehler · Jun 23, 2023 · Jun 19, 2023 · Jun 21, 2023 · Jun 23, 2023
diff --git a/rules/REQUEST-900-EXCLUSION-RULES-BEFORE-CRS.conf.example b/rules/REQUEST-900-EXCLUSION-RULES-BEFORE-CRS.conf.example
@@ -176,7 +176,7 @@
 # conditions will not be matched against the following rules:
 #
 # - id: 911100 (allowed methods)
-# - id: 913100,913110 (scan detection)
+# - id: 913100 (scan detection)
 # - id: 920280 (missing/empty host header)
 # - id: 920350 (IP address in host header)
 # - tag: attack-disclosure (all RESPONSE-*-DATA-LEAKAGES rules)
@@ -191,7 +191,6 @@
 #       SecRule REQUEST_HEADERS:User-Agent "@pm ELB-HealthChecker" \
 #           "ctl:ruleRemoveById=911100,\
 #           ctl:ruleRemoveById=913100,\
-#           ctl:ruleRemoveById=913110,\
 #           ctl:ruleRemoveById=920280,\
 #           ctl:ruleRemoveById=920350,\
 #           ctl:ruleRemoveByTag=attack-disclosure"
diff --git a/rules/REQUEST-913-SCANNER-DETECTION.conf b/rules/REQUEST-913-SCANNER-DETECTION.conf
@@ -55,26 +55,6 @@ SecRule REQUEST_HEADERS:User-Agent "@pmFromFile scanners-user-agents.data" \
     severity:'CRITICAL',\
     setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'"
 
-SecRule REQUEST_HEADERS_NAMES|REQUEST_HEADERS "@pmFromFile scanners-headers.data" \
-    "id:913110,\
-    phase:1,\
-    block,\
-    capture,\
-    t:none,\
-    msg:'Found request header associated with security scanner',\
-    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\
-    tag:'application-multi',\
-    tag:'language-multi',\
-    tag:'platform-multi',\
-    tag:'attack-reputation-scanner',\
-    tag:'paranoia-level/1',\
-    tag:'OWASP_CRS',\
-    tag:'capec/1000/118/224/541/310',\
-    tag:'PCI/6.5.10',\
-    ver:'OWASP_CRS/4.0.0-rc1',\
-    severity:'CRITICAL',\
-    setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'"
-
 
 SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 2" "id:913013,phase:1,pass,nolog,skipAfter:END-REQUEST-913-SCANNER-DETECTION"
 SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 2" "id:913014,phase:2,pass,nolog,skipAfter:END-REQUEST-913-SCANNER-DETECTION"

diff --git a/rules/scanners-headers.data b/rules/scanners-headers.data
diff --git a/tests/regression/tests/REQUEST-913-SCANNER-DETECTION/913110.yaml b/tests/regression/tests/REQUEST-913-SCANNER-DETECTION/913110.yaml