Difference between revisions of "WAF 330205"
(Created page with "{{Infobox |header1 = Rule 330205 |label2 = Status |data2 = Active |label3 = Alert Message |data3 = Atomicorp.com WAF Rules: Joomla Exploit Bot }} = Description = This rule ...") |
m |
||
| Line 11: | Line 11: | ||
This rule detects a known malicious attack tool. If your system is getting alerts on this rule your system is being attacked. This is not a false positive. | This rule detects a known malicious attack tool. If your system is getting alerts on this rule your system is being attacked. This is not a false positive. | ||
| − | The rule detects the "Bot for JCE" attack tool. This tool | + | The rule detects the "Bot for JCE" attack tool. This attack tool attacks vulnerable Joomla installations. It does this blindly, which means it just attacks the system ''without checking'' to see if Joomla is installed on the system and if a vulnerable Joomla installation is detected on the system the system will be compromised, if this rule is disabled. This means this attack tool indiscriminetly attacks systems that do not have Joomla installed. |
| + | |||
| + | If your system is being targeted with this tool we do not recommend you disable this rule, even if you do not have Joomla installed. This rule is telling you that someone is attacking your system, you should block this source. | ||
| + | |||
= Troubleshooting = | = Troubleshooting = | ||
Revision as of 13:09, 12 December 2013
| Rule 330205 | |
|---|---|
| Status | Active |
| Alert Message | Atomicorp.com WAF Rules: Joomla Exploit Bot |
Contents |
Description
This rule detects a known malicious attack tool. If your system is getting alerts on this rule your system is being attacked. This is not a false positive.
The rule detects the "Bot for JCE" attack tool. This attack tool attacks vulnerable Joomla installations. It does this blindly, which means it just attacks the system without checking to see if Joomla is installed on the system and if a vulnerable Joomla installation is detected on the system the system will be compromised, if this rule is disabled. This means this attack tool indiscriminetly attacks systems that do not have Joomla installed.
If your system is being targeted with this tool we do not recommend you disable this rule, even if you do not have Joomla installed. This rule is telling you that someone is attacking your system, you should block this source.
Troubleshooting
False Positives
None. This rule detects a known malicious attack tool. If your system is getting alerts on this rule your system is being attacked. This is not a false positive.
Tuning Guidance
None. Do not disable this rule.
Additional Information
Blog Articles
Similar Rules
None.
Knowledge Base Articles
None.
Outside References
None.
