WAF detection types

info

WAF is optional. To use WAF, please apply through this inquiry form.

Summary

The following information provides you with details about the various WAF tags:

• Name: The name of the signal that can be used for reference or description.
• Tags: The name of the signal applied to matched requests, which can be used to search within KurocoEdge logs.
• Description: An outline of what the signal represents or indicates.

Detection type list

Attacks

Name	Tags	Description
Attack Tooling	USERAGENT	Attack Tooling is the use of automated software to identify security vulnerabilities or to attempt to exploit a discovered vulnerability
AWS SSRF	AWS-SSRF	Server Side Request Forgery (SSRF) is a type of attack where the web application sends unauthorized requests to internal systems. AWS SSRF attacks use SSRF to obtain Amazon Web Services (AWS) keys and gain access to S3 buckets and their data.
Backdoor	BACKDOOR	A backdoor signal is a request which attempts to determine if a common backdoor file is present on the system
Command Execution	CMDEXE	Command Execution is the attempt to gain control or damage a target system through arbitrary system commands by means of user input
Cross Site Scripting	XSS	Cross-Site Scripting is the attempt to hijack a user’s account or web-browsing session through malicious JavaScript code
Directory Traversal	TRAVERSAL	Directory Traversal is the attempt to navigate privileged folders throughout a system in hopes of obtaining sensitive information
Log4J JNDI	LOG4J-JNDI	Log4J JNDI attacks attempt to exploit the Log4Shell vulnerability present in Log4J versions earlier than 2.16.0
SQL Injection	SQLI	SQL Injection is an attempt to gain unauthorized access to an application or obtain privileged information by executing arbitrary database queries

Anomalies

Name	Tags	Description
Abnormal Path	ABNORMALPATH	Abnormal Path indicates that the original path differs from the normalized path (e.g., /foo/./bar is normalized to /foo/bar)
Bad Hop Headers	BHH	Bad Hop Headers indicate an HTTP smuggling attempt through either a malformed Transfer-Encoding (TE) or Content-Length (CL) header, or a well-formed TE and CL header
Blocked Requests	BLOCKED	Requests blocked by Signal Sciences
Code Injection PHP	CODEINJECTION	Code Injection attempts to gain control of or damage a target system through arbitrary application code commands via user input. Note: This signal only covers PHP code and is currently in an experimental phase. Contact support if you encounter any issues with this signal.
Compression Detected	COMPRESSED	The POST request body is compressed and cannot be inspected. For example, if a “Content-Encoding: gzip” request header is specified and the POST body is not plain text.
Datacenter Traffic	DATACENTER	Datacenter Traffic is non-organic traffic originating from identified hosting providers. This type of traffic is not commonly associated with a real end user.
Double Encoding	DOUBLEENCODING	Double Encoding checks for the evasion technique of double encoding html characters
Duplicate Header Names	DUPLICATE-HEADERS	A request that has duplicate header field names. This may represent a programming error or an automated or malicious request. Current detected headers are:_Authorization,_Content-Length,_Content-Type,_Host, and_Transfer-Encoding.
Forceful Browsing	FORCEFULBROWSING	Forceful Browsing is the failed attempt to access admin pages
GraphQL API	GRAPHQL-API	Indicates a GraphQL API request.
GraphQL Duplicate Variables	GRAPHQL-DUPLICATE-VARIABLES	Indicates a GraphQL request that contains duplicated variables.
GraphQL IDE	GRAPHQL-IDE	Indicates a request originating from a GraphQL Interactive Development Environment (IDE).
GraphQL Introspection	GRAPHQL-INTROSPECTION	Indicates an attempt to obtain the schema of a GraphQL API. The schema can be used to identify which resources are available, informing subsequent attacks.
GraphQL Max Depth	GRAPHQL-DEPTH	Indicates a request has reached or exceeded the maximum depth allowed on the server for GraphQL API queries
GraphQL Missing Required Operation Name	GRAPHQL-MISSING-REQUIRED-OPERATION-NAME	Indicates a request has multiple GraphQL operations but does not define which operation to execute.
GraphQL Syntax	GRAPHQL-SYNTAX	Indicates a request that contains invalid GraphQL syntax. This may be related to a programming error or a malicious request.
GraphQL Undefined Variable	GRAPHQL-UNDEFINED-VARIABLES	Indicates a request made to a GraphQL API containing more variables than expected by a function. This can be used to obfuscate malicious requests.
HTTP 403 Errors	HTTP403	Forbidden. This is commonly seen when the request for a url has been protected by the server’s configuration.
HTTP 404 Errors	HTTP404	Not Found. This is commonly seen when the request for a page or asset does not exist or cannot be found by the server.
HTTP 429 Errors	HTTP429	Too Many Requests. This is commonly seen when rate-limiting is used to slow down the number of active connections to a server.
HTTP 4XX Errors	HTTP4XX	4xx Status Codes commonly refer to client request errors
HTTP 500 Errors	HTTP500	Internal Server Error. This is commonly seen when a request generates an unhandled application error.
HTTP 503 Errors	HTTP503	Service Unavailable. This is commonly seen when a web service is overloaded or sometimes taken down for maintenance.
HTTP 5XX Errors	HTTP5XX	5xx Status Codes commonly refer to server related issues
HTTP Response Splitting	RESPONSESPLIT	Identifies when CRLF characters are submitted as input to the application to inject headers into the HTTP response
Invalid Encoding	NOTUTF8	Invalid Encoding can cause the server to translate malicious characters from a request into a response, causing either a denial of service or XSS
JSON Encoding Error	JSON-ERROR	A POST, PUT, or PATCH request body that is specified as containing JSON within the “Content-Type” request header but contains JSON parsing errors. This is often related to a programming error or an automated or malicious request.
Malformed Data in the request body	MALFORMED-DATA	A POST, PUT or PATCH request body that is malformed according to the “Content-Type” request header. For example, if a “Content-Type: application/x-www-form-urlencoded” request header is specified and contains a POST body that is json. This is often a programming error, automated or malicious request. Requires agent 3.2 or higher.
Malicious IP Traffic	SANS	Signal Sciences regularly imports the SANS Internet Storm Center list of IP addresses reported to have engaged in malicious activity.
Network Effect	SIGSCI-IP	Whenever an IP is flagged due to a malicious signal by our decision engine, that IP will be propagated to all customers. We then log subsequent requests from those IP addresses that contain any additional signal for the duration of the flag.
Missing “Content-Type” request header	NO-CONTENT-TYPE	A POST, PUT or PATCH request that does not have a “Content-Type” request header. By default application servers should assume “Content-Type: text/plain; charset=us-ascii” in this case. Many automated and malicious requests may be missing “Content Type”.
No User Agent	NOUA	Many automated and malicious requests use fake or missing User-Agents to make it difficult to identify the type of device making the requests
Null Byte	NULLBYTE	Null bytes do not normally appear in a request and indicate the request is malformed and potentially malicious
Private Files	PRIVATEFILE	Private files are usually confidential in nature, such as an Apache .htaccess file, or a configuration file which could leak sensitive information
Scanner	SCANNER	Identifies popular scanning services and tools
SearchBot Impostor	IMPOSTOR	Search bot impostor is someone pretending to be a Google or Bing search bot, but who is not legitimate
Site Flagged IP	SITE-FLAGGED-IP	Indicates a request was received from an IP flagged for exceeding attack thresholds for a specific site. This signal is only included with the Premier platform.
Tor Traffic	TORNODE	Tor is software that conceals a user’s identity. A spike in Tor traffic can indicate an attacker trying to mask their location.
Weak TLS	WEAKTLS	Weak TLS. A web server’s configuration allows SSL/TLS connections to be established with an obsolete cipher suite or protocol version. This signal is based on inspecting a small percent of requests. Also, some architectures and Signal Sciences’ language SDK modules do not support this signal.
XML Encoding Error	XML-ERROR	A POST, PUT, or PATCH request body that is specified as containing XML within the “Content-Type” request header but contains XML parsing errors. This is often related to a programming error or an automated or malicious request.

More Information

• For more information, visit Signal Sciences.