FM / imh-modsec

/etc/apache2/conf.d/imh-modsec

Name	Size	Mode	Actions
html/	-	0755	rm
01_base_rules.conf	19822	0644	edit dl rm
05_additional_directives.conf	6950	0644	edit dl rm
15_bad_requests.conf	2300	0644	edit dl rm
19_bad_bots.conf	5363	0644	edit dl rm
20_known_hacks.conf	4886	0644	edit dl rm
21_spam_scripts.conf	1599	0644	edit dl rm
31_shellshock.conf	806	0644	edit dl rm
40_wordpress.conf	9511	0644	edit dl rm
40_xmlrpc.conf	2374	0644	edit dl rm
47_premium_web_builder.conf	83	0644	edit dl rm
alibaba_cidrtrack.lua	12769	0644	edit dl rm
alibaba_network.txt	1789	0644	edit dl rm
bot_budget_bots.txt	113	0644	edit dl rm
bot_ratelimit.lua	2921	0644	edit dl rm
imh-renumber.csv	2460	0644	edit dl rm

Edit: /etc/apache2/conf.d/imh-modsec/21_spam_scripts.conf (1599B)

# both.conf
# Rules to block access to known spam scripts

# Will block if the Host header is in all caps with a lower-case tld,
# if the request URI ends with ".php" (case insensitive), if the user agent
# matches the list of patterns, if the method is POST and if Referer is not set.
# See #3885 for details
SecRule REQUEST_HEADERS:Host "[0-9A-Z\.-]\.[a-z\.]+" \
    "chain,log,deny,status:406,id:13421,t:none,\
    msg:'POST request appears to be to spam mailer'"
SecRule REQUEST_FILENAME "\.php$" "chain,t:lowercase"
SecRule REQUEST_HEADERS:User-Agent "^Mozilla/5.0$" "chain,t:removeWhitespace"
SecRule REQUEST_HEADERS_NAMES "!@contains Referer" "chain"
SecRule REQUEST_METHOD "POST"

# Block for long postdata from sketchy clients 3976 
SecRule ARGS "[0-9a-zA-Z=&%]{80}" \
    "chain,log,deny,status:406 \
    msg:'Unusual POST data',id:13701,t:none"
SecRule REQUEST_FILENAME "\.php$" "chain,t:lowercase"
SecRule REQUEST_HEADERS:Accept "^[*]/[*]$" "chain,t:removeWhitespace"
SecRule REQUEST_HEADERS:User-Agent "^Mozilla/5.0$" "chain,t:none,t:removeWhitespace"
SecRule REQUEST_METHOD "POST"

# Block POSTs to a known spam script payload
SecRule REQUEST_FILENAME "sys\d{5,}\.php$" "chain,log,deny,status:406 \
    msg:'Access to known spam script',id:13703,t:lowercase,t:removeWhitespace"
SecRule REQUEST_METHOD "POST"

# Ticket 7140 <https://trac.imhtech.net/T3/ticket/7140>
<Files "sitedata.php">
    SecRule ARGS_NAMES "@pm text subj data address port login password email name headers to" \
        "log,deny,status:406,msg:'Access to known spam script',id:13704,t:removeWhitespace"
</Files>

# both.conf # Rules to block access to known spam scripts # Will block if the Host header is in all caps with a lower-case tld, # if the request URI ends with ".php" (case insensitive), if the user agent # matches the list of patterns, if the method is POST and if Referer is not set. # See #3885 for details SecRule REQUEST_HEADERS:Host "[0-9A-Z\.-]\.[a-z\.]+" \ "chain,log,deny,status:406,id:13421,t:none,\ msg:'POST request appears to be to spam mailer'" SecRule REQUEST_FILENAME "\.php$" "chain,t:lowercase" SecRule REQUEST_HEADERS:User-Agent "^Mozilla/5.0$" "chain,t:removeWhitespace" SecRule REQUEST_HEADERS_NAMES "!@contains Referer" "chain" SecRule REQUEST_METHOD "POST" # Block for long postdata from sketchy clients 3976 SecRule ARGS "[0-9a-zA-Z=&%]{80}" \ "chain,log,deny,status:406 \ msg:'Unusual POST data',id:13701,t:none" SecRule REQUEST_FILENAME "\.php$" "chain,t:lowercase" SecRule REQUEST_HEADERS:Accept "^[*]/[*]$" "chain,t:removeWhitespace" SecRule REQUEST_HEADERS:User-Agent "^Mozilla/5.0$" "chain,t:none,t:removeWhitespace" SecRule REQUEST_METHOD "POST" # Block POSTs to a known spam script payload SecRule REQUEST_FILENAME "sys\d{5,}\.php$" "chain,log,deny,status:406 \ msg:'Access to known spam script',id:13703,t:lowercase,t:removeWhitespace" SecRule REQUEST_METHOD "POST" # Ticket 7140 SecRule ARGS_NAMES "@pm text subj data address port login password email name headers to" \ "log,deny,status:406,msg:'Access to known spam script',id:13704,t:removeWhitespace"