{"action":"created","issue":{"url":"https://api.github.com/repos/SpiderLabs/owasp-modsecurity-crs/issues/430","repository_url":"https://api.github.com/repos/SpiderLabs/owasp-modsecurity-crs","labels_url":"https://api.github.com/repos/SpiderLabs/owasp-modsecurity-crs/issues/430/labels{/name}","comments_url":"https://api.github.com/repos/SpiderLabs/owasp-modsecurity-crs/issues/430/comments","events_url":"https://api.github.com/repos/SpiderLabs/owasp-modsecurity-crs/issues/430/events","html_url":"https://github.com/SpiderLabs/owasp-modsecurity-crs/pull/430","id":166939343,"number":430,"title":"Replace RCE pmf rule by set of rules","user":{"login":"lifeforms","id":3464056,"avatar_url":"https://avatars.githubusercontent.com/u/3464056?v=3","gravatar_id":"","url":"https://api.github.com/users/lifeforms","html_url":"https://github.com/lifeforms","followers_url":"https://api.github.com/users/lifeforms/followers","following_url":"https://api.github.com/users/lifeforms/following{/other_user}","gists_url":"https://api.github.com/users/lifeforms/gists{/gist_id}","starred_url":"https://api.github.com/users/lifeforms/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/lifeforms/subscriptions","organizations_url":"https://api.github.com/users/lifeforms/orgs","repos_url":"https://api.github.com/users/lifeforms/repos","events_url":"https://api.github.com/users/lifeforms/events{/privacy}","received_events_url":"https://api.github.com/users/lifeforms/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":6,"created_at":"2016-07-21T23:19:05Z","updated_at":"2016-07-23T20:07:01Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/SpiderLabs/owasp-modsecurity-crs/pulls/430","html_url":"https://github.com/SpiderLabs/owasp-modsecurity-crs/pull/430","diff_url":"https://github.com/SpiderLabs/owasp-modsecurity-crs/pull/430.diff","patch_url":"https://github.com/SpiderLabs/owasp-modsecurity-crs/pull/430.patch"},"body":"Resolves #318.\r\n\r\nNew rules:\r\n\r\n932100: Remote Command Execution: Unix Command Injection\r\n932110: Remote Command Execution: Windows Command Injection\r\n932120: Remote Command Execution: Windows PowerShell Command Found\r\n932130: Remote Command Execution: Unix Shell Expression Found\r\n932140: Remote Command Execution: Windows FOR/IF Command Found\r\n932150: Remote Command Execution: Direct Unix Command Execution"},"comment":{"url":"https://api.github.com/repos/SpiderLabs/owasp-modsecurity-crs/issues/comments/234737503","html_url":"https://github.com/SpiderLabs/owasp-modsecurity-crs/pull/430#issuecomment-234737503","issue_url":"https://api.github.com/repos/SpiderLabs/owasp-modsecurity-crs/issues/430","id":234737503,"user":{"login":"lifeforms","id":3464056,"avatar_url":"https://avatars.githubusercontent.com/u/3464056?v=3","gravatar_id":"","url":"https://api.github.com/users/lifeforms","html_url":"https://github.com/lifeforms","followers_url":"https://api.github.com/users/lifeforms/followers","following_url":"https://api.github.com/users/lifeforms/following{/other_user}","gists_url":"https://api.github.com/users/lifeforms/gists{/gist_id}","starred_url":"https://api.github.com/users/lifeforms/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/lifeforms/subscriptions","organizations_url":"https://api.github.com/users/lifeforms/orgs","repos_url":"https://api.github.com/users/lifeforms/repos","events_url":"https://api.github.com/users/lifeforms/events{/privacy}","received_events_url":"https://api.github.com/users/lifeforms/received_events","type":"User","site_admin":false},"created_at":"2016-07-23T20:07:01Z","updated_at":"2016-07-23T20:07:01Z","body":"Some work-in-progress added. I guess the whitespace trick is the way to go, it seems to reduce FP on the Reddit dataset. I have also removed Windows Powershell aliases, because they can't be invoked directly from cmd, and I assume a shell uses cmd (#YOLO).\r\n\r\n- Unix hits on Reddit dataset go from 450 to 339 (25% lowered)\r\n- Windows hits on Reddit dataset go from 1023 to 779 (24% lowered)\r\n\r\nMore work is needed to reliably do this though. On Unix, you can do `cat<config.php`. On Windows, you can do `more.com`, `more<config.php`, `more/e config.php`. So to close this hole more regexp magic is needed."}}
{"actor":{"display_login":"lifeforms"}}