8/23/2020 Tuning Google Cloud Armor WAF rules
| Google Cloud Armor Documentation
Tuning Google Cloud Armor WAF rules
Precon gured rules
Google Cloud Armor precon gured rules are complex web application rewall (WAF) rules with
dozens of signatures that are compiled from open source industry standards. Google offers
these rules as-is. The rules enable Google Cloud Armor to evaluate dozens of distinct tra c
signatures by referring to conveniently-named rules, rather than requiring you to de ne each
signature manually.
The following table contains a comprehensive list of precon gured WAF rules that are available
for use in a Google Cloud Armor security policy. The rule source is ModSecurity Core Rule Set
3.0.2 (https://modsecurity.org/crs/).
Google Cloud Armor rule name ModSecurity rule name Current Status
sqli-stable SQL injection In sync with sqli-canary
sqli-canary SQL injection Latest
xss-stable Cross-site scripting In sync with xss-canary
xss-canary Cross-site scripting Latest
l -stable (Beta) Local le inclusion In sync with l -canary
l -canary (Beta) Local le inclusion Latest
r -stable (Beta) Remote le inclusion In sync with r -canary
r -canary (Beta) Remote le inclusion Latest
rce-stable (Beta) Remote code execution In sync with rce-canary
rce-canary (Beta) Remote code execution Latest
About rule tuning
https://cloud.google.com/armor/docs/rule-tuning/ 1/12
8/23/2020 Tuning Google Cloud Armor WAF rules | Google Cloud Armor Documentation
Each precon gured rule consists of multiple signatures. Incoming requests are evaluated
against the precon gured rules. A request matches a precon gured rule if the request matches
any of the signatures that are associated with the precon gured rule. A match is made when
the evaluatePreconfiguredExpr() command returns the value true.
If you decide that a precon gured rule matches more tra c than is necessary or if the rule is
blocking tra c that needs to be allowed, the rule can be tuned to disable noisy or otherwise
unnecessary signatures. To disable signatures in a particular precon gured rule, you provide a
list of IDs of the unwanted signatures to the evaluatePreconfiguredExpr() command. For
example, here is an example match condition in the rules language with a tuned rule:
atePreconfiguredExpr('xss-stable', ['owasp-crs-v020901-id981136-xss', 'owasp-crs-v02
Precon gured ModSecurity rules
SQL injection
Signature ID (CRS Rule Sensitivity
Description
ID) Level
owasp-crs-v030001- 1 SQL Injection Attack: Common DB Names Detected
id942140-sqli
owasp-crs-v030001- 1 Detects blind sqli tests using sleep() or benchmark().
id942160-sqli
owasp-crs-v030001- 1 Detects SQL benchmark and sleep injection attempts including
id942170-sqli conditional queries
owasp-crs-v030001- 1 Detects MSSQL code execution and information gathering attempts
id942190-sqli
owasp-crs-v030001- 1 Looking for integer over ow attacks
id942220-sqli
owasp-crs-v030001- 1 Detects conditional SQL injection attempts
id942230-sqli
https://cloud.google.com/armor/docs/rule-tuning/ 2/12
8/23/2020 Tuning Google Cloud Armor WAF rules | Google Cloud Armor Documentation
Signature ID (CRS Rule Sensitivity
Description
ID) Level
owasp-crs-v030001- 1 Detects MySQL charset switch and MSSQL DoS attempts
id942240-sqli
owasp-crs-v030001- 1 Detects MATCH AGAINST
id942250-sqli
owasp-crs-v030001- 1 Looking for basic sql injection. Common attack string for mysql
id942270-sqli
owasp-crs-v030001- 1 Detects Postgres pg_sleep injection
id942280-sqli
owasp-crs-v030001- 1 Finds basic MongoDB SQL injection attempts
id942290-sqli
owasp-crs-v030001- 1 Detects MySQL and PostgreSQL stored procedure/function injections
id942320-sqli
owasp-crs-v030001- 1 Detects MySQL UDF injection and other data/structure manipulation
id942350-sqli attempts
owasp-crs-v030001- 1 Detects concatenated basic SQL injection and SQLLFI attempts
id942360-sqli
owasp-crs-v030001- 2 SQL Injection Attack: Common Injection Testing Detected
id942110-sqli
owasp-crs-v030001- 2 SQL Injection Attack: SQL Operator Detected
id942120-sqli
owasp-crs-v030001- 2 SQL Injection Attack
id942150-sqli
owasp-crs-v030001- 2 Detects basic SQL authentication bypass attempts 1/3
id942180-sqli
owasp-crs-v030001- 2 Detects MySQL comment-/space-obfuscated injections and backtick
id942200-sqli termination
owasp-crs-v030001- 2 Detects chained SQL injection attempts 1/2
id942210-sqli
owasp-crs-v030001- 2 Detects basic SQL authentication bypass attempts 2/3
id942260-sqli
https://cloud.google.com/armor/docs/rule-tuning/ 3/12
8/23/2020 Tuning Google Cloud Armor WAF rules | Google Cloud Armor Documentation
Signature ID (CRS Rule Sensitivity
Description
ID) Level
owasp-crs-v030001- 2 Detects MySQL comments
id942300-sqli
owasp-crs-v030001- 2 Detects chained SQL injection attempts 2/2
id942310-sqli
owasp-crs-v030001- 2 Detects classic SQL injection probings 1/2
id942330-sqli
owasp-crs-v030001- 2 Detects basic SQL authentication bypass attempts 3/3
id942340-sqli
owasp-crs-v030001- 2 SQL Injection Attack
id942380-sqli
owasp-crs-v030001- 2 SQL Injection Attack
id942390-sqli
owasp-crs-v030001- 2 SQL Injection Attack
id942400-sqli
owasp-crs-v030001- 2 SQL Injection Attack
id942410-sqli
owasp-crs-v030001- 2 Restricted SQL Character Anomaly Detection (args): # of special
id942430-sqli characters exceeded (12)
owasp-crs-v030001- 2 SQL Comment Sequence Detected.
id942440-sqli
owasp-crs-v030001- 2 SQL Hex Encoding Identi ed
id942450-sqli
owasp-crs-v030001- 3 Detects HAVING injections
id942251-sqli
owasp-crs-v030001- 3 Restricted SQL Character Anomaly Detection (cookies): # of special
id942420-sqli characters exceeded (8)
owasp-crs-v030001- 3 Restricted SQL Character Anomaly Detection (args): # of special
id942431-sqli characters exceeded (6)
owasp-crs-v030001- 3 Meta-Character Anomaly Detection Alert - Repetitive Non-Word
id942460-sqli Characters
https://cloud.google.com/armor/docs/rule-tuning/ 4/12
8/23/2020 Tuning Google Cloud Armor WAF rules | Google Cloud Armor Documentation
Signature ID (CRS Rule Sensitivity
Description
ID) Level
owasp-crs-v030001- 4 Restricted SQL Character Anomaly Detection (cookies): # of special
id942421-sqli characters exceeded (3)
owasp-crs-v030001- 4 Restricted SQL Character Anomaly Detection (args): # of special
id942432-sqli characters exceeded (2)
To con gure a rule at a particular sensitivity level, disable the signatures at greater sensitivity
levels:
SQLi Sensitivity Level 1
evaluatePreconfiguredExpr('sqli-stable', ['owasp-crs-v030001-id942110-sqli',
'owasp-crs-v030001-id942120-sqli',
'owasp-crs-v030001-id942150-sqli',
'owasp-crs-v030001-id942180-sqli',
'owasp-crs-v030001-id942200-sqli',
'owasp-crs-v030001-id942210-sqli',
'owasp-crs-v030001-id942260-sqli',
'owasp-crs-v030001-id942300-sqli',
'owasp-crs-v030001-id942310-sqli',
'owasp-crs-v030001-id942330-sqli',
'owasp-crs-v030001-id942340-sqli',
'owasp-crs-v030001-id942380-sqli',
'owasp-crs-v030001-id942390-sqli',
'owasp-crs-v030001-id942400-sqli',
'owasp-crs-v030001-id942410-sqli',
'owasp-crs-v030001-id942430-sqli',
'owasp-crs-v030001-id942440-sqli',
'owasp-crs-v030001-id942450-sqli',
'owasp-crs-v030001-id942251-sqli',
'owasp-crs-v030001-id942420-sqli',
'owasp-crs-v030001-id942431-sqli',
'owasp-crs-v030001-id942460-sqli',
'owasp-crs-v030001-id942421-sqli',
'owasp-crs-v030001-id942432-sqli']
)
https://cloud.google.com/armor/docs/rule-tuning/ 5/12
8/23/2020 Tuning Google Cloud Armor WAF rules | Google Cloud Armor Documentation
SQLi Sensitivity Level 2
evaluatePreconfiguredExpr('sqli-stable', ['owasp-crs-v030001-id942251-sqli',
'owasp-crs-v030001-id942420-sqli',
'owasp-crs-v030001-id942431-sqli',
'owasp-crs-v030001-id942460-sqli',
'owasp-crs-v030001-id942421-sqli',
'owasp-crs-v030001-id942432-sqli']
)
SQLi Sensitivity Level 3
evaluatePreconfiguredExpr('sqli-stable', ['owasp-crs-v030001-id942421-sqli',
'owasp-crs-v030001-id942432-sqli']
)
SQLi Sensitivity Level 4
evaluatePreconfiguredExpr('sqli-stable')
Cross-Site Scripting (XSS)
Sensitivity
Signature ID (Rule ID) Description
Level
owasp-crs-v030001-id941110- 1 XSS Filter - Category 1: Script Tag Vector
xss
owasp-crs-v030001-id941120- 1 XSS Filter - Category 2: Event Handler Vector
xss
owasp-crs-v030001-id941130- 1 XSS Filter - Category 3: Attribute Vector
xss
https://cloud.google.com/armor/docs/rule-tuning/ 6/12
8/23/2020 Tuning Google Cloud Armor WAF rules | Google Cloud Armor Documentation
Sensitivity
Signature ID (Rule ID) Description
Level
owasp-crs-v030001-id941140- 1 XSS Filter - Category 4: JavaScript URI Vector
xss
owasp-crs-v030001-id941160- 1 NoScript XSS InjectionChecker: HTML Injection
xss
owasp-crs-v030001-id941170- 1 NoScript XSS InjectionChecker: Attribute Injection
xss
owasp-crs-v030001-id941180- 1 Node-Validator Blacklist Keywords
xss
owasp-crs-v030001-id941190- 1 IE XSS Filters - Attack Detected.
xss
owasp-crs-v030001-id941200- 1 IE XSS Filters - Attack Detected.
xss
owasp-crs-v030001-id941210- 1 IE XSS Filters - Attack Detected.
xss
owasp-crs-v030001-id941220- 1 IE XSS Filters - Attack Detected.
xss
owasp-crs-v030001-id941230- 1 IE XSS Filters - Attack Detected.
xss
owasp-crs-v030001-id941240- 1 IE XSS Filters - Attack Detected.
xss
owasp-crs-v030001-id941250- 1 IE XSS Filters - Attack Detected.
xss
owasp-crs-v030001-id941260- 1 IE XSS Filters - Attack Detected.
xss
owasp-crs-v030001-id941270- 1 IE XSS Filters - Attack Detected.
xss
owasp-crs-v030001-id941280- 1 IE XSS Filters - Attack Detected.
xss
owasp-crs-v030001-id941290- 1 IE XSS Filters - Attack Detected.
xss
https://cloud.google.com/armor/docs/rule-tuning/ 7/12
8/23/2020 Tuning Google Cloud Armor WAF rules | Google Cloud Armor Documentation
Sensitivity
Signature ID (Rule ID) Description
Level
owasp-crs-v030001-id941300- 1 IE XSS Filters - Attack Detected.
xss
owasp-crs-v030001-id941310- 1 US-ASCII Malformed Encoding XSS Filter - Attack
xss Detected.
owasp-crs-v030001-id941350- 1 UTF-7 Encoding IE XSS - Attack Detected.
xss
owasp-crs-v030001-id941150- 2 XSS Filter - Category 5: Disallowed HTML Attributes
xss
owasp-crs-v030001-id941320- 2 Possible XSS Attack Detected - HTML Tag Handler
xss
owasp-crs-v030001-id941330- 2 IE XSS Filters - Attack Detected.
xss
owasp-crs-v030001-id941340- 2 IE XSS Filters - Attack Detected.
xss
To con gure a rule at a particular sensitivity level, disable the signatures at greater sensitivity
levels:
XSS Sensitivity Level 1
evaluatePreconfiguredExpr('xss-stable', ['owasp-crs-v030001-id941150-xss',
'owasp-crs-v030001-id941320-xss',
'owasp-crs-v030001-id941330-xss',
'owasp-crs-v030001-id941340-xss'])
All signatures for XSS are below sensitivity level 2. The following con guration works for other
sensitivity levels:
XSS Sensitivity Level 2/3/4
https://cloud.google.com/armor/docs/rule-tuning/ 8/12
8/23/2020 Tuning Google Cloud Armor WAF rules | Google Cloud Armor Documentation
XSS Sensitivity Level 2/3/4
evaluatePreconfiguredExpr('xss-stable')
Local le inclusion (LFI) (beta)
Signature ID (Rule ID) Sensitivity Level Description
owasp-crs-v030001-id930100-l 1 Path Traversal Attack (/../)
owasp-crs-v030001-id930110-l 1 Path Traversal Attack (/../)
owasp-crs-v030001-id930120-l 1 OS File Access Attempt
owasp-crs-v030001-id930130-l 1 Restricted File Access Attempt
All signatures for LFI are at sensitivity level 1. The following con guration works for all
sensitivity levels:
LFI Sensitivity Levels 1/2/3/4
evaluatePreconfiguredExpr('lfi-canary')
Remote Code Execution (RCE) (Beta)
Signature ID (Rule ID) Sensitivity Level Description
owasp-crs-v030001-id932100-rce 1 UNIX Command Injection
owasp-crs-v030001-id932105-rce 1 UNIX Command Injection
https://cloud.google.com/armor/docs/rule-tuning/ 9/12
8/23/2020 Tuning Google Cloud Armor WAF rules | Google Cloud Armor Documentation
Signature ID (Rule ID) Sensitivity Level Description
owasp-crs-v030001-id932110-rce 1 Windows Command Injection
owasp-crs-v030001-id932115-rce 1 Windows Command Injection
owasp-crs-v030001-id932120-rce 1 Windows PowerShell Command Found
owasp-crs-v030001-id932130-rce 1 Unix Shell Expression Found
owasp-crs-v030001-id932140-rce 1 Windows FOR/IF Command Found
owasp-crs-v030001-id932150-rce 1 Direct UNIX Command Execution
owasp-crs-v030001-id932160-rce 1 UNIX Shell Code Found
owasp-crs-v030001-id932170-rce 1 Shellshock (CVE-2014-6271)
owasp-crs-v030001-id932171-rce 1 Shellshock (CVE-2014-6271)
All signatures for RCE are at sensitivity level 1. The following con guration works for all
sensitivity levels:
RCE Sensitivity Levels 1/2/3/4
evaluatePreconfiguredExpr('rce-canary')
Remote File Inclusion (RFI) (Beta)
Sensitivity
Signature ID (Rule ID) Description
Level
owasp-crs-v030001-id931100- 1 URL Parameter using IP Address
r
owasp-crs-v030001-id931110- 1 Common RFI Vulnerable Parameter Name used w/URL
r Payload
https://cloud.google.com/armor/docs/rule-tuning/ 10/12
8/23/2020 Tuning Google Cloud Armor WAF rules | Google Cloud Armor Documentation
Sensitivity
Signature ID (Rule ID) Description
Level
owasp-crs-v030001-id931120- 1 URL Payload Used w/Trailing Question Mark Character (?)
r
owasp-crs-v030001-id931130- 2 Off-Domain Reference/Link
r
To con gure a rule at a particular sensitivity level, disable the signatures at greater sensitivity
levels:
RFI Sensitivity Level 1
evaluatePreconfiguredExpr('rfi-canary', ['owasp-crs-v030001-id931130-rfi'])
RFI Sensitivity Level 2/3/4
evaluatePreconfiguredExpr('rfi-canary')
What's next
To con gure security policies, rules, and expressions, use the instructions in Con guring
security policies (/armor/docs/con gure-security-policies) and Creating Google Cloud Armor
security policies, rules, and expressions
(/armor/docs/con gure-security-policies#creating-policy-rules).
Except as otherwise noted, the content of this page is licensed under the Creative Commons Attribution 4.0 License
(https://creativecommons.org/licenses/by/4.0/), and code samples are licensed under the Apache 2.0 License
(https://www.apache.org/licenses/LICENSE-2.0). For details, see the Google Developers Site Policies
(https://developers.google.com/site-policies). Java is a registered trademark of Oracle and/or its a liates.
Last updated 2020-08-11 UTC.
https://cloud.google.com/armor/docs/rule-tuning/ 11/12
8/23/2020 Tuning Google Cloud Armor WAF rules | Google Cloud Armor Documentation
https://cloud.google.com/armor/docs/rule-tuning/ 12/12
