coreruleset · dune73 · Jun 8, 2023 · Jun 19, 2023 · Jun 19, 2023 · Jun 19, 2023
diff --git a/rules/REQUEST-900-EXCLUSION-RULES-BEFORE-CRS.conf.example b/rules/REQUEST-900-EXCLUSION-RULES-BEFORE-CRS.conf.example
@@ -176,7 +176,7 @@
 # conditions will not be matched against the following rules:
 #
 # - id: 911100 (allowed methods)
-# - id: 913100,913110,913120,913101,913102 (scan detection)
+# - id: 913100,913120,913101,913102 (scan detection)
 # - id: 920280 (missing/empty host header)
 # - id: 920350 (IP address in host header)
 # - tag: attack-disclosure (all RESPONSE-*-DATA-LEAKAGES rules)
@@ -191,7 +191,6 @@
 #       SecRule REQUEST_HEADERS:User-Agent "@pm ELB-HealthChecker" \
 #           "ctl:ruleRemoveById=911100,\
 #           ctl:ruleRemoveById=913100,\
-#           ctl:ruleRemoveById=913110,\
 #           ctl:ruleRemoveById=913120,\
 #           ctl:ruleRemoveById=913101,\
 #           ctl:ruleRemoveById=913102,\

diff --git a/rules/REQUEST-913-SCANNER-DETECTION.conf b/rules/REQUEST-913-SCANNER-DETECTION.conf
@@ -56,27 +56,6 @@ SecRule REQUEST_HEADERS:User-Agent "@pmFromFile scanners-user-agents.data" \
     SecRule MATCHED_VARS "!@rx ^(?:urlgrabber/[0-9\.]+ yum/[0-9\.]+|mozilla/[0-9\.]+ ecairn-grabber/[0-9\.]+ \(\+http://ecairn.com/grabber\))$" \
         "setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'"
 
-SecRule REQUEST_HEADERS_NAMES|REQUEST_HEADERS "@pmFromFile scanners-headers.data" \
-    "id:913110,\
-    phase:1,\
-    block,\
-    capture,\
-    t:none,\
-    msg:'Found request header associated with security scanner',\
-    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\
-    tag:'application-multi',\
-    tag:'language-multi',\
-    tag:'platform-multi',\
-    tag:'attack-reputation-scanner',\
-    tag:'paranoia-level/1',\
-    tag:'OWASP_CRS',\
-    tag:'capec/1000/118/224/541/310',\
-    tag:'PCI/6.5.10',\
-    ver:'OWASP_CRS/4.0.0-rc1',\
-    severity:'CRITICAL',\
-    setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'"
-
-
 
 SecRule REQUEST_FILENAME|ARGS "@pmFromFile scanners-urls.data" \
     "id:913120,\

diff --git a/rules/scanners-headers.data b/rules/scanners-headers.data
diff --git a/tests/regression/tests/REQUEST-913-SCANNER-DETECTION/913110.yaml b/tests/regression/tests/REQUEST-913-SCANNER-DETECTION/913110.yaml
diff --git a/util/fp-finder/spell.sh b/util/fp-finder/spell.sh