{
  "version": "2.1",
  "metadata": {
    "rules_version": "rules_rasp"
  },
  "rules": [
    {
      "id": "rasp-930-100",
      "name": "Local file inclusion exploit",
      "tags": {
        "type": "lfi",
        "category": "vulnerability_trigger",
        "cwe": "22",
        "capec": "1000/255/153/126",
        "confidence": "0",
        "module": "rasp"
      },
      "conditions": [
        {
          "parameters": {
            "resource": [
              {
                "address": "server.io.fs.file"
              }
            ],
            "params": [
              {
                "address": "server.request.query"
              },
              {
                "address": "server.request.body"
              },
              {
                "address": "server.request.path_params"
              },
              {
                "address": "grpc.server.request.message"
              },
              {
                "address": "graphql.server.all_resolvers"
              },
              {
                "address": "graphql.server.resolver"
              }
            ]
          },
          "operator": "lfi_detector"
        }
      ],
      "transformers": [],
      "on_match": [
        "stack_trace"
      ]
    },
    {
      "id": "rasp-934-100",
      "name": "Server-side request forgery exploit",
      "tags": {
        "type": "ssrf",
        "category": "vulnerability_trigger",
        "cwe": "918",
        "capec": "1000/225/115/664",
        "confidence": "0",
        "module": "rasp"
      },
      "conditions": [
        {
          "parameters": {
            "resource": [
              {
                "address": "server.io.net.url"
              }
            ],
            "params": [
              {
                "address": "server.request.query"
              },
              {
                "address": "server.request.body"
              },
              {
                "address": "server.request.path_params"
              },
              {
                "address": "grpc.server.request.message"
              },
              {
                "address": "graphql.server.all_resolvers"
              },
              {
                "address": "graphql.server.resolver"
              }
            ]
          },
          "operator": "ssrf_detector"
        }
      ],
      "transformers": [],
      "on_match": [
        "stack_trace"
      ]
    },
    {
      "id": "rasp-942-100",
      "name": "SQL injection exploit",
      "tags": {
        "type": "sql_injection",
        "category": "vulnerability_trigger",
        "cwe": "89",
        "capec": "1000/152/248/66",
        "confidence": "0",
        "module": "rasp"
      },
      "conditions": [
        {
          "parameters": {
            "resource": [
              {
                "address": "server.db.statement"
              }
            ],
            "params": [
              {
                "address": "server.request.query"
              },
              {
                "address": "server.request.body"
              },
              {
                "address": "server.request.path_params"
              },
              {
                "address": "graphql.server.all_resolvers"
              },
              {
                "address": "graphql.server.resolver"
              }
            ],
            "db_type": [
              {
                "address": "server.db.system"
              }
            ]
          },
          "operator": "sqli_detector"
        }
      ],
      "transformers": [],
      "on_match": [
        "stack_trace"
      ]
    },
    {
      "id": "rasp-932-100",
      "name": "Shell injection exploit",
      "tags": {
        "type": "command_injection",
        "category": "vulnerability_trigger",
        "cwe": "77",
        "capec": "1000/152/248/88",
        "confidence": "0",
        "module": "rasp"
      },
      "conditions": [
        {
          "parameters": {
            "resource": [
              {
                "address": "server.sys.shell.cmd"
              }
            ],
            "params": [
              {
                "address": "server.request.query"
              },
              {
                "address": "server.request.body"
              },
              {
                "address": "server.request.path_params"
              },
              {
                "address": "grpc.server.request.message"
              },
              {
                "address": "graphql.server.all_resolvers"
              },
              {
                "address": "graphql.server.resolver"
              }
            ]
          },
          "operator": "shi_detector"
        }
      ],
      "transformers": [],
      "on_match": [
        "stack_trace"
      ]
    },
    {
      "id": "rasp-932-110",
      "name": "OS command injection exploit",
      "tags": {
        "type": "command_injection",
        "category": "vulnerability_trigger",
        "cwe": "77",
        "capec": "1000/152/248/88",
        "confidence": "0",
        "module": "rasp"
      },
      "conditions": [
        {
          "parameters": {
            "resource": [
              {
                "address": "server.sys.exec.cmd"
              }
            ],
            "params": [
              {
                "address": "server.request.query"
              },
              {
                "address": "server.request.body"
              },
              {
                "address": "server.request.path_params"
              },
              {
                "address": "grpc.server.request.message"
              },
              {
                "address": "graphql.server.all_resolvers"
              },
              {
                "address": "graphql.server.resolver"
              }
            ]
          },
          "operator": "cmdi_detector"
        }
      ],
      "transformers": [],
      "on_match": [
        "stack_trace"
      ]
    },
    {
      "id": "apiA-100-001",
      "name": "API 10 tag rule on headers",
      "tags": {
        "type": "api10 request headers",
        "category": "attack_attempt"
      },
      "conditions": [
        {
          "parameters": {
            "inputs": [
              {
                "address": "server.io.net.request.headers",
                "key_path": [
                  "Host"
                ]
              },
              {
                "address": "server.io.net.request.headers",
                "key_path": [
                  "TagHost"
                ]
              }
            ],
            "list": ["www.datadoghq.com"]
          },
          "operator": "exact_match"
        }
      ],
      "output": {
        "event": true,
        "keep": true,
        "attributes": {
          "_dd.appsec.trace.mark": {
            "value": "TAG_API10_HEADER"
          }
        }
      },
      "on_match": []
    },
    {
      "id": "apiA-100-002",
      "name": "API 10 tag rule on body",
      "tags": {
        "type": "api10 request body",
        "category": "attack_attempt"
      },
      "conditions": [
        {
          "parameters": {
            "inputs": [
              {
                "address": "server.io.net.request.body",
                "key_path": [
                  "payload"
                ]
              }
            ],
            "list": ["qw2jedrkjerbgol23ewpfirj2qw3or"]
          },
          "operator": "exact_match"
        }
      ],
      "output": {
        "event": true,
        "keep": true,
        "attributes": {
          "_dd.appsec.trace.mark": {
            "value": "TAG_API10_BODY"
          }
        }
      },
      "on_match": []
    }

  ]
}