Mirage dashboard

# Credential stuffing with common weak passwords
# Matches POST requests to the login endpoint submitting well-known default or weak credential pairs (admin/admin, admin/password, admin/123456, root/toor, administrator/Welcome1, test/test) which are c
# not expressible in stock nginx (needs request-body inspection); use the ModSecurity rule

# Credential stuffing with common weak passwords
# requires: SecRequestBodyAccess On
SecRule REQUEST_METHOD "@streq POST" "id:1529789,phase:2,deny,status:403,log,msg:'Credential stuffing with common weak passwords',chain"
    SecRule REQUEST_FILENAME "@rx (?i)^/login$" "t:none,chain"
    SecRule REQUEST_BODY "@rx (?i)username=(admin|root|administrator|test)&password=(admin|password|123456|toor|Welcome1|test)" "t:none,t:urlDecodeUni"

# Credential stuffing with common weak passwords
# Matches POST requests to the login endpoint submitting well-known default or weak credential pairs (admin/admin, admin/password, admin/123456, root/toor, administrator/Welcome1, test/test) which are c
# not expressible as a Sigma web-log rule (web servers do not log request bodies); use the ModSecurity rule

# Sensitive file probe
# Attackers request well-known sensitive files at root level (.env, .git/config, backup.zip, db.sql) that legitimate users never access legitimate zip files are under /downloads/.
set $mr_1094923 "";
if ($request_method = GET) { set $mr_1094923 "${mr_1094923}M"; }
if ($uri ~* "^/\\.(env|git/config)$|^/backup\\.zip$|^/db\\.sql$") { set $mr_1094923 "${mr_1094923}P"; }
if ($mr_1094923 = "MP") { return 403; }

# Sensitive file probe
SecRule REQUEST_METHOD "@streq GET" "id:1094923,phase:1,deny,status:403,log,msg:'Sensitive file probe',chain"
    SecRule REQUEST_FILENAME "@rx (?i)^/\.(env|git/config)$|^/backup\.zip$|^/db\.sql$" "t:none"

title: 'Sensitive file probe'
id: 9c53bd98-ab8c-5ca4-b898-06a898b0ffd2
status: experimental
description: 'Attackers request well-known sensitive files at root level (.env, .git/config, backup.zip, db.sql) that legitimate users never access legitimate zip files are under /downloads/.'
author: Mirage honeypot analyst
logsource:
    category: webserver
detection:
  selection:
    cs-method: GET
    c-uri|re: '(?i)^/\.(env|git/config)$|^/backup\.zip$|^/db\.sql$'
  condition: selection
level: medium
tags:
    - attack.t1595.002

# Admin panel enumeration
# Scanners systematically probe common admin panel paths legitimate traffic uses deeper, application-specific routes like /admin/audit.
set $mr_1536110 "";
if ($request_method = GET) { set $mr_1536110 "${mr_1536110}M"; }
if ($uri ~* "^/(admin|administrator|wp-login\\.php|phpmyadmin|console|server-status|cgi-bin|info\\.php|test)/?$") { set $mr_1536110 "${mr_1536110}P"; }
if ($mr_1536110 = "MP") { return 403; }

# Admin panel enumeration
SecRule REQUEST_METHOD "@streq GET" "id:1536110,phase:1,deny,status:403,log,msg:'Admin panel enumeration',chain"
    SecRule REQUEST_FILENAME "@rx (?i)^/(admin|administrator|wp-login\.php|phpmyadmin|console|server-status|cgi-bin|info\.php|test)/?$" "t:none"

title: 'Admin panel enumeration'
id: 9981ffd9-0665-5508-a0c4-46163b9509ae
status: experimental
description: 'Scanners systematically probe common admin panel paths legitimate traffic uses deeper, application-specific routes like /admin/audit.'
author: Mirage honeypot analyst
logsource:
    category: webserver
detection:
  selection:
    cs-method: GET
    c-uri|re: '(?i)^/(admin|administrator|wp-login\.php|phpmyadmin|console|server-status|cgi-bin|info\.php|test)/?$'
  condition: selection
level: medium
tags:
    - attack.t1595.002

# Injection payloads on auth endpoints
# Attackers append SQLi, path traversal, and XSS payloads to login/admin endpoints benign requests only carry harmless paging or tracking parameters.
# note: nginx sees $args URL-encoded, so encoded variants may need extra patterns
set $mr_1283502 "";
if ($request_method = GET) { set $mr_1283502 "${mr_1283502}M"; }
if ($uri ~* "^/(admin|login)/?$") { set $mr_1283502 "${mr_1283502}P"; }
if ($args ~* "(\\b|[?&])(id|file|q)=([^&]*(\\'|\\.\\./|<script|alert\\())") { set $mr_1283502 "${mr_1283502}Q"; }
if ($mr_1283502 = "MPQ") { return 403; }

# Injection payloads on auth endpoints
SecRule REQUEST_METHOD "@streq GET" "id:1283502,phase:1,deny,status:403,log,msg:'Injection payloads on auth endpoints',chain"
    SecRule REQUEST_FILENAME "@rx (?i)^/(admin|login)/?$" "t:none,chain"
    SecRule QUERY_STRING "@rx (?i)(\b|[?&])(id|file|q)=([^&]*(\'|\.\./|<script|alert\())" "t:none,t:urlDecodeUni"

title: 'Injection payloads on auth endpoints'
id: 6c207e90-f73c-5da3-b81e-142411ce8f40
status: experimental
description: 'Attackers append SQLi, path traversal, and XSS payloads to login/admin endpoints benign requests only carry harmless paging or tracking parameters.'
author: Mirage honeypot analyst
logsource:
    category: webserver
detection:
  selection:
    cs-method: GET
    c-uri|re: '(?i)^/(admin|login)/?$'
    cs-uri-query|re: '(?i)(\b|[?&])(id|file|q)=([^&]*(\''|\.\./|<script|alert\())'
  condition: selection
level: medium
tags:
    - attack.t1190