# Apache ModSecurity rules for SHELLS
SecRuleEngine On
SecRule REQUEST_URI "@contains\ punkholicshell" "id:1314,phase:1,deny,status:403,log,msg:'shells attack detected'"
SecRule REQUEST_URI "\^n\ \ \ \ \ \ n\ \ \ \ \ \ \ \ \ \ \ \ \ azrail\ \[0\-9\.\]\+\ by\ C\-W\-M" "id:1315,phase:1,deny,status:403,log,msg:'shells attack detected'"
SecRule REQUEST_URI "\^nnWeb\ Shell" "id:1305,phase:1,deny,status:403,log,msg:'shells attack detected'"
SecRule REQUEST_URI "lama's'hell\ v\.\ \[0\-9\.\]\+" "id:1306,phase:1,deny,status:403,log,msg:'shells attack detected'"
SecRule REQUEST_URI "\^PHP\ Web\ Shellrnrnrn\ \ \ \ " "id:1308,phase:1,deny,status:403,log,msg:'shells attack detected'"
SecRule REQUEST_URI ">SmEvK_PaThAn\ Shell\ v\[0\-9\]\+\ coded\ by\ CasuS\ \[0\-9\.\]\+\ by\ MafiABoY" "id:1301,phase:1,deny,status:403,log,msg:'shells attack detected'"
SecRule REQUEST_URI "s72\ Shell\ v\[0\-9\.\]\+\ Codinf\ by\ Cr@zy_King" "id:1311,phase:1,deny,status:403,log,msg:'shells attack detected'"
SecRule REQUEST_URI "\^rnrnrnPhpSpy\ Ver\ \[0\-9\]\+" "id:1312,phase:1,deny,status:403,log,msg:'shells attack detected'"
SecRule REQUEST_URI "\^\ \*n\[\ \]\+n\[\ \]\+lostDC\ \-" "id:1307,phase:1,deny,status:403,log,msg:'shells attack detected'"
SecRule REQUEST_URI "@contains\ <h1\ style="margin\-bottom:\ 0">webadmin\.php</h1>" "id:1319,phase:1,deny,status:403,log,msg:'shells attack detected'"
SecRule REQUEST_URI "\^\ <html><head><title>::\ b374k\ m1n1\ \[0\-9\.\]\+\ ::" "id:1318,phase:1,deny,status:403,log,msg:'shells attack detected'"
SecRule REQUEST_URI "Symlink_Sa\ \[0\-9\.\]\+" "id:1300,phase:1,deny,status:403,log,msg:'shells attack detected'"
SecRule REQUEST_URI "NGHshell\ \[0\-9\.\]\+\ by\ Cr4shn\$" "id:1303,phase:1,deny,status:403,log,msg:'shells attack detected'"
SecRule REQUEST_URI "\^n\.\*\?\ \~\ Shell\ Inn