This article lists the specific header names and values that are set by AWS WAF to detect various OWASP Top 10 threats. Cequence policies uses these header names and values to detect and block the specific threats within Cequence Defenders. This categorization reflects the landscape of web application threats detected by Cequence WAAP, from traditional injection attacks to modern supply chain vulnerabilities like Log4j exploits.

The purpose of this article is to inform customers of the specific header names and values that are used within your WAF Policies. 

Note: Do not edit the header names and values unless specifically instructed by Cequence Customer Support. To disable specific WAF Rules or Policies, follow the instructions in the Configuring WAF Policies article. 

User Agent and Bot Detection

This category encompasses threats related to missing or malicious user agent strings, which are commonly exploited by automated bots and scrapers to disguise their identity or bypass basic filtering mechanisms.

Request Size Restrictions

These rules detect requests that exceed predetermined size limits across various HTTP components, helping prevent resource exhaustion attacks and unusually large payloads that may indicate malicious activity.

Server-Side Request Forgery (SSRF)

These detections identify attempts to exploit server-side request forgery vulnerabilities, particularly targeting AWS EC2 metadata endpoints which could expose sensitive instance credentials and configuration data.

Local File Inclusion (LFI)

These rules detect attempts to access local files on the server through path traversal and other file inclusion techniques that could expose sensitive system files or application code.

Restricted File Extensions

This category identifies requests attempting to access files with potentially dangerous extensions that should not be accessible through web requests, helping prevent exposure of configuration files, source code, or other sensitive resources.

Remote File Inclusion (RFI)

These detections target attempts to include remote files or resources in application execution, which could lead to code execution, data exfiltration, or other malicious activities through externally hosted content.

Cross-Site Scripting (XSS)

This group of rules identifies patterns associated with cross-site scripting attacks across various input vectors, protecting against malicious script injection that could compromise user sessions or steal sensitive data.

Administrative Interface Protection

This rule specifically protects administrative paths and interfaces from unauthorized access attempts, helping secure backend management systems and configuration endpoints.

Java Deserialization Remote Code Execution

These rules detect attempts to exploit Java deserialization vulnerabilities, which can lead to remote code execution through maliciously crafted serialized objects passed in various request components.

Known Malicious Patterns

This category encompasses various known malicious request patterns including localhost targeting, suspicious HTTP methods, exploitable paths, and attempts to access commonly vulnerable endpoints.

Log4j Remote Code Execution

These detections specifically target attempts to exploit the Log4j vulnerability (CVE-2021-44228), monitoring for malicious JNDI lookup patterns that could lead to remote code execution through various input vectors.

SQL Injection

This comprehensive set of rules detects various SQL injection attack patterns, including both standard and extended pattern matching across multiple input vectors to prevent database compromise and data exfiltration attempts.