{
    "version": "1.0.0",
    "last_updated": "2025-12-10",
    "description": "VMPFence WAF Rules - Comprehensive Security Patterns",
    "total_rules": 146,
    "rules": [
        {
            "rule_id": "CMD-INJECT-FREE",
            "enabled": 1,
            "category": "COMMAND_INJECTION",
            "severity": 2,
            "pattern": "/(;[\\s]*(?:ls|cat|whoami|id|pwd|uname|wget|curl|rm|chmod|mv|cp|kill|ps|nc|netcat|bash|sh)\\b|\\|[\\s]*(?:ls|cat|whoami|id|pwd|uname)\\b|`[^`]+`|\\$\\([^)]+\\))/i",
            "description": "Basic command injection detection - Shell metacharacters (;, |, backticks, $()`) and common Unix commands",
            "version": "1.0",
            "score": 100,
            "action": "block",
            "whitelist": 0
        },
        {
            "rule_id": "CMD-INJECT-PREMIUM",
            "enabled": 1,
            "category": "COMMAND_INJECTION",
            "severity": 2,
            "pattern": "/exec\\s*\\(|shell_exec\\s*\\(|passthru\\s*\\(|system\\s*\\(|popen\\s*\\(|proc_open\\s*\\(|`.*(?:cat|ls|wget|curl|nc|bash|sh|python|perl|ruby|php)/i",
            "description": "Advanced command injection detection - PHP execution functions and complex command chains (Premium)",
            "version": "1.0",
            "score": 100,
            "action": "block",
            "whitelist": 0
        },
        {
            "rule_id": "LDAP-INJECT-001",
            "enabled": 1,
            "category": "LDAP_INJECTION",
            "severity": 2,
            "pattern": "/(\\*\\)\\(uid=|\\*\\)\\(cn=|\\*\\)\\(mail=|\\(\\|\\(|\\)\\(|\\)\\)\\(|\\(\\&\\(|[a-zA-Z0-9]+\\*)/i",
            "description": "LDAP injection detection - Prevents LDAP filter manipulation attacks (Premium)",
            "version": "1.0",
            "score": 100,
            "action": "block",
            "whitelist": 0
        },
        {
            "rule_id": "LFI-001",
            "enabled": 1,
            "category": "LFI",
            "severity": 4,
            "pattern": "/(\\.\\.[\\/\\\\]|etc[\\/\\\\]passwd|boot\\.ini|win\\.ini)/i",
            "description": "Detects local file inclusion attempts like ../ traversal, /etc/passwd access",
            "version": "1.0",
            "score": 100,
            "action": "block",
            "whitelist": 0
        },
        {
            "rule_id": "NULL-BYTE-001",
            "enabled": 1,
            "category": "NULL_BYTE",
            "severity": 2,
            "pattern": "/(%00|\\\\x00|\\\\0)/i",
            "description": "Null byte injection attempt - often used to bypass file extension checks",
            "version": "1.0",
            "score": 100,
            "action": "block",
            "whitelist": 0
        },
        {
            "rule_id": "RCE-001-ENTERPRISE",
            "enabled": 1,
            "category": "RCE",
            "severity": 4,
            "pattern": "/(eval\\(|exec\\(|system\\(|passthru\\(|shell_exec\\()/i",
            "description": "Remote code execution detection - Dangerous PHP functions (Enterprise Tier)",
            "version": "1.0",
            "score": 100,
            "action": "block",
            "whitelist": 0
        },
        {
            "rule_id": "RCE-PARAM-NAMES",
            "enabled": 1,
            "category": "RCE",
            "severity": 2,
            "pattern": "/(eval|exec|system|shell_exec|passthru|proc_open|popen)/i",
            "description": "Detects dangerous PHP function names used as parameter names",
            "version": "1.0",
            "score": 100,
            "action": "block",
            "whitelist": 0
        },
        {
            "rule_id": "RFI-001",
            "enabled": 1,
            "category": "RFI",
            "severity": 4,
            "pattern": "/(http:\\/\\/|https:\\/\\/|ftp:\\/\\/|php:\\/\\/|data:\\/\\/|expect:\\/\\/)/i",
            "description": "Detects remote file inclusion using protocol wrappers like php://, data://, http://",
            "version": "1.0",
            "score": 100,
            "action": "block",
            "whitelist": 0
        },
        {
            "rule_id": "SQL-001-FREE",
            "enabled": 1,
            "category": "SQLI",
            "severity": 3,
            "pattern": "/(union.*select|select.*from|insert.*into|drop.*table|delete.*from|'\\s*or\\s*'|'\\s*or\\s*\\d+=\\d+|or\\s+\\d+=\\d+)/i",
            "description": "SQL injection detection - Common patterns: UNION SELECT, OR 1=1, INSERT INTO, DROP TABLE (Free Tier)",
            "version": "1.0",
            "score": 100,
            "action": "block",
            "whitelist": 0
        },
        {
            "rule_id": "TEST-FREE-001",
            "enabled": 1,
            "category": "XSS",
            "severity": 2,
            "pattern": "<script>",
            "description": "XSS protection - Free tier test",
            "version": "1.0",
            "score": 100,
            "action": "block",
            "whitelist": 0
        },
        {
            "rule_id": "TEST-PREMIUM-001",
            "enabled": 1,
            "category": "RCE",
            "severity": 4,
            "pattern": "/eval\\(/i",
            "description": "RCE protection - Premium only",
            "version": "1.0",
            "score": 100,
            "action": "block",
            "whitelist": 0
        },
        {
            "rule_id": "WP-ADMIN-ACCESS-001",
            "enabled": 1,
            "category": "WORDPRESS",
            "severity": 3,
            "pattern": "/(\\/wp-admin\\/|\\/wp-login\\.php)/i",
            "description": "Restricts access to WordPress admin and login pages from unauthorized IPs or non-browser clients.",
            "version": "1.0",
            "score": 100,
            "action": "block",
            "whitelist": 0
        },
        {
            "rule_id": "WP-BACKUP-001",
            "enabled": 1,
            "category": "WORDPRESS",
            "severity": 1,
            "pattern": "/\\.(sql|zip|tar\\.gz|gz|bak|old|backup|dump)(\\?|$)/i",
            "description": "Prevents access to backup files (.sql, .zip, .tar.gz, .bak, .old, .backup, .dump)",
            "version": "1.0",
            "score": 100,
            "action": "block",
            "whitelist": 0
        },
        {
            "rule_id": "WP-COMMENT-SPAM-001",
            "enabled": 1,
            "category": "SPAM",
            "severity": 2,
            "pattern": "/(<a\\s+href=|\\[url=|http(s)?:\\/\\/)/i",
            "description": "Blocks comment submissions containing excessive links or spam indicators to reduce automated spam in WordPress comments.",
            "version": "1.0",
            "score": 100,
            "action": "block",
            "whitelist": 0
        },
        {
            "rule_id": "WP-CONFIG-ACCESS-001",
            "enabled": 1,
            "category": "WORDPRESS",
            "severity": 4,
            "pattern": "/(wp-config\\.php|wp-config-sample\\.php|\\.env|\\.htaccess|readme\\.html)/i",
            "description": "Prevents direct access to sensitive WordPress configuration and system files like wp-config.php, .env, and .htaccess.",
            "version": "1.0",
            "score": 100,
            "action": "block",
            "whitelist": 0
        },
        {
            "rule_id": "WP-DIR-LISTING-001",
            "enabled": 1,
            "category": "SERVER_MISCONFIG",
            "severity": 2,
            "pattern": "/(Index of \\/wp-content|Index of \\/wp-includes|Index of \\/wp-admin)/i",
            "description": "Detects and blocks directory listing exposures within core WordPress directories.",
            "version": "1.0",
            "score": 100,
            "action": "block",
            "whitelist": 0
        },
        {
            "rule_id": "WP-ENUM-FILES-001",
            "enabled": 1,
            "category": "WORDPRESS",
            "severity": 1,
            "pattern": "/wp-content\\/(plugins|themes)\\/[^\\/]+\\/(readme\\.txt|style\\.css|screenshot\\.(png|jpg|gif))/i",
            "description": "Prevents plugin and theme enumeration by blocking access to readme.txt, style.css, and screenshot files",
            "version": "1.0",
            "score": 100,
            "action": "block",
            "whitelist": 0
        },
        {
            "rule_id": "WP-FILE-EDIT-001",
            "enabled": 1,
            "category": "WORDPRESS",
            "severity": 4,
            "pattern": "/(\\/wp-admin\\/theme-editor\\.php|\\/wp-admin\\/plugin-editor\\.php)/i",
            "description": "Disables direct access to the WordPress file editors to reduce risk of code injection via admin panel.",
            "version": "1.0",
            "score": 100,
            "action": "block",
            "whitelist": 0
        },
        {
            "rule_id": "WP-MALWARE-SIG-001",
            "enabled": 1,
            "category": "MALWARE",
            "severity": 4,
            "pattern": "/(base64_decode\\(|gzinflate\\(|shell_exec\\(|passthru\\(|eval\\()/i",
            "description": "Detects potential malware signatures or obfuscated PHP payloads commonly found in compromised WordPress installations.",
            "version": "1.0",
            "score": 100,
            "action": "block",
            "whitelist": 0
        },
        {
            "rule_id": "WP-PLUGIN-EXPLOIT-001",
            "enabled": 1,
            "category": "WORDPRESS",
            "severity": 4,
            "pattern": "/(\\/wp-content\\/plugins\\/[^\\/]+\\/(ajax|admin|upload)\\.php(\\?|$))/i",
            "description": "Blocks direct access to vulnerable plugin PHP endpoints commonly exploited for RCE or file upload vulnerabilities.",
            "version": "1.0",
            "score": 100,
            "action": "block",
            "whitelist": 0
        },
        {
            "rule_id": "WP-REST-ABUSE-001",
            "enabled": 1,
            "category": "WORDPRESS",
            "severity": 3,
            "pattern": "/(\\/wp-json\\/wp\\/v2\\/users|\\/wp-json\\/wp\\/v2\\/comments|\\/wp-json\\/wp\\/v2\\/posts)/i",
            "description": "Blocks abuse of the WordPress REST API to prevent user enumeration or unauthorized data harvesting.",
            "version": "1.0",
            "score": 100,
            "action": "block",
            "whitelist": 0
        },
        {
            "rule_id": "WP-SETUP-001",
            "enabled": 1,
            "category": "WORDPRESS",
            "severity": 2,
            "pattern": "/wp-admin\\/(install|setup-config|upgrade)\\.php/i",
            "description": "Blocks access to WordPress installation and setup files (should be removed after WP installation)",
            "version": "1.0",
            "score": 100,
            "action": "block",
            "whitelist": 0
        },
        {
            "rule_id": "WP-UPLOAD-001",
            "enabled": 1,
            "category": "FILE_UPLOAD",
            "severity": 3,
            "pattern": "/(\\.php|\\.phtml|\\.php5|\\.phar)$/i",
            "description": "Blocks upload of executable PHP files through WordPress media or plugin upload interfaces.",
            "version": "1.0",
            "score": 100,
            "action": "block",
            "whitelist": 0
        },
        {
            "rule_id": "WP-USER-ENUM-001",
            "enabled": 1,
            "category": "WORDPRESS",
            "severity": 2,
            "pattern": "/(\\?author=\\d+|\\/\\?author=\\d+)/i",
            "description": "Prevents user enumeration attempts by blocking author query patterns revealing usernames.",
            "version": "1.0",
            "score": 100,
            "action": "block",
            "whitelist": 0
        },
        {
            "rule_id": "XSS-001-PRO",
            "enabled": 1,
            "category": "XSS",
            "severity": 2,
            "pattern": "/(<script|javascript:|onerror=|onload=)/i",
            "description": "XSS pattern detection - Script tags and event handlers (Pro Tier)",
            "version": "1.0",
            "score": 100,
            "action": "block",
            "whitelist": 0
        },
        {
            "rule_id": "XSS-EVENT-001",
            "enabled": 1,
            "category": "XSS",
            "severity": 3,
            "pattern": "/(onload|onerror|onclick|onmouseover|onfocus|onblur)\\s*=/i",
            "description": "Detects XSS attempts using HTML event handlers like onload, onerror, onclick",
            "version": "1.0",
            "score": 100,
            "action": "block",
            "whitelist": 0
        },
        {
            "rule_id": "badbot-00b6cf8b",
            "enabled": 1,
            "category": "SCANNER",
            "severity": 1,
            "pattern": "/AfD\\-Verbotsverfahren/i",
            "description": "Bad bot: AfD-Verbotsverfahren",
            "version": "1.0",
            "score": 90,
            "action": "block",
            "whitelist": 0
        },
        {
            "rule_id": "badbot-089f5742",
            "enabled": 1,
            "category": "SCANNER",
            "severity": 1,
            "pattern": "/BDFetch/i",
            "description": "Bad bot: BDFetch",
            "version": "1.0",
            "score": 90,
            "action": "block",
            "whitelist": 0
        },
        {
            "rule_id": "badbot-107014a9",
            "enabled": 1,
            "category": "SCANNER",
            "severity": 1,
            "pattern": "/Anarchy/i",
            "description": "Bad bot: Anarchy",
            "version": "1.0",
            "score": 90,
            "action": "block",
            "whitelist": 0
        },
        {
            "rule_id": "badbot-17c8fd75",
            "enabled": 1,
            "category": "SCANNER",
            "severity": 1,
            "pattern": "/CATExplorador/i",
            "description": "Bad bot: CATExplorador",
            "version": "1.0",
            "score": 90,
            "action": "block",
            "whitelist": 0
        },
        {
            "rule_id": "badbot-186e7027",
            "enabled": 1,
            "category": "SCANNER",
            "severity": 1,
            "pattern": "/BBBike/i",
            "description": "Bad bot: BBBike",
            "version": "1.0",
            "score": 90,
            "action": "block",
            "whitelist": 0
        },
        {
            "rule_id": "badbot-1e50ca52",
            "enabled": 1,
            "category": "SCANNER",
            "severity": 1,
            "pattern": "/CheTeam/i",
            "description": "Bad bot: CheTeam",
            "version": "1.0",
            "score": 90,
            "action": "block",
            "whitelist": 0
        },
        {
            "rule_id": "badbot-24184f20",
            "enabled": 1,
            "category": "SCANNER",
            "severity": 1,
            "pattern": "/Backlink\\-Ceck/i",
            "description": "Bad bot: Backlink-Ceck",
            "version": "1.0",
            "score": 90,
            "action": "block",
            "whitelist": 0
        },
        {
            "rule_id": "badbot-259467f4",
            "enabled": 1,
            "category": "SCANNER",
            "severity": 1,
            "pattern": "/Atomseobot/i",
            "description": "Bad bot: Atomseobot",
            "version": "1.0",
            "score": 90,
            "action": "block",
            "whitelist": 0
        },
        {
            "rule_id": "badbot-28e5ce6c",
            "enabled": 1,
            "category": "SCANNER",
            "severity": 1,
            "pattern": "/Brandprotect/i",
            "description": "Bad bot: Brandprotect",
            "version": "1.0",
            "score": 90,
            "action": "block",
            "whitelist": 0
        },
        {
            "rule_id": "badbot-2a509501",
            "enabled": 1,
            "category": "SCANNER",
            "severity": 1,
            "pattern": "/CSHttp/i",
            "description": "Bad bot: CSHttp",
            "version": "1.0",
            "score": 90,
            "action": "block",
            "whitelist": 0
        },
        {
            "rule_id": "badbot-2aeeec6a",
            "enabled": 1,
            "category": "SCANNER",
            "severity": 1,
            "pattern": "/Aboundexbot/i",
            "description": "Bad bot: Aboundexbot",
            "version": "1.0",
            "score": 90,
            "action": "block",
            "whitelist": 0
        },
        {
            "rule_id": "badbot-2c0847f6",
            "enabled": 1,
            "category": "SCANNER",
            "severity": 1,
            "pattern": "/Cosmos/i",
            "description": "Bad bot: Cosmos",
            "version": "1.0",
            "score": 90,
            "action": "block",
            "whitelist": 0
        },
        {
            "rule_id": "badbot-2e4f1bd2",
            "enabled": 1,
            "category": "SCANNER",
            "severity": 1,
            "pattern": "/Blackboard/i",
            "description": "Bad bot: Blackboard",
            "version": "1.0",
            "score": 90,
            "action": "block",
            "whitelist": 0
        },
        {
            "rule_id": "badbot-2e9c4290",
            "enabled": 1,
            "category": "SCANNER",
            "severity": 1,
            "pattern": "/360Spider/i",
            "description": "Bad bot: 360Spider",
            "version": "1.0",
            "score": 90,
            "action": "block",
            "whitelist": 0
        },
        {
            "rule_id": "badbot-2f397f90",
            "enabled": 1,
            "category": "SCANNER",
            "severity": 1,
            "pattern": "/Alligator/i",
            "description": "Bad bot: Alligator",
            "version": "1.0",
            "score": 90,
            "action": "block",
            "whitelist": 0
        },
        {
            "rule_id": "badbot-3263b8b8",
            "enabled": 1,
            "category": "SCANNER",
            "severity": 1,
            "pattern": "/ALittle\\\\\\ Client/i",
            "description": "Bad bot: ALittle\\ Client",
            "version": "1.0",
            "score": 90,
            "action": "block",
            "whitelist": 0
        },
        {
            "rule_id": "badbot-34417410",
            "enabled": 1,
            "category": "SCANNER",
            "severity": 1,
            "pattern": "/Cliqzbot/i",
            "description": "Bad bot: Cliqzbot",
            "version": "1.0",
            "score": 90,
            "action": "block",
            "whitelist": 0
        },
        {
            "rule_id": "badbot-3ba1299b",
            "enabled": 1,
            "category": "SCANNER",
            "severity": 1,
            "pattern": "/Black\\\\\\ Hole/i",
            "description": "Bad bot: Black\\ Hole",
            "version": "1.0",
            "score": 90,
            "action": "block",
            "whitelist": 0
        },
        {
            "rule_id": "badbot-3f5e9591",
            "enabled": 1,
            "category": "SCANNER",
            "severity": 1,
            "pattern": "/CherryPicker/i",
            "description": "Bad bot: CherryPicker",
            "version": "1.0",
            "score": 90,
            "action": "block",
            "whitelist": 0
        },
        {
            "rule_id": "badbot-43b7739d",
            "enabled": 1,
            "category": "SCANNER",
            "severity": 1,
            "pattern": "/Bitacle/i",
            "description": "Bad bot: Bitacle",
            "version": "1.0",
            "score": 90,
            "action": "block",
            "whitelist": 0
        },
        {
            "rule_id": "badbot-43e1e4b9",
            "enabled": 1,
            "category": "SCANNER",
            "severity": 1,
            "pattern": "/Alexibot/i",
            "description": "Bad bot: Alexibot",
            "version": "1.0",
            "score": 90,
            "action": "block",
            "whitelist": 0
        },
        {
            "rule_id": "badbot-4a96f249",
            "enabled": 1,
            "category": "SCANNER",
            "severity": 1,
            "pattern": "/Buck/i",
            "description": "Bad bot: Buck",
            "version": "1.0",
            "score": 90,
            "action": "block",
            "whitelist": 0
        },
        {
            "rule_id": "badbot-4c34e931",
            "enabled": 1,
            "category": "SCANNER",
            "severity": 1,
            "pattern": "/Boardreader/i",
            "description": "Bad bot: Boardreader",
            "version": "1.0",
            "score": 90,
            "action": "block",
            "whitelist": 0
        },
        {
            "rule_id": "badbot-4e0b79a3",
            "enabled": 1,
            "category": "SCANNER",
            "severity": 1,
            "pattern": "/Aipbot/i",
            "description": "Bad bot: Aipbot",
            "version": "1.0",
            "score": 90,
            "action": "block",
            "whitelist": 0
        },
        {
            "rule_id": "badbot-5482aa53",
            "enabled": 1,
            "category": "SCANNER",
            "severity": 1,
            "pattern": "/CCBot/i",
            "description": "Bad bot: CCBot",
            "version": "1.0",
            "score": 90,
            "action": "block",
            "whitelist": 0
        },
        {
            "rule_id": "badbot-5769e98e",
            "enabled": 1,
            "category": "SCANNER",
            "severity": 1,
            "pattern": "/BuzzSumo/i",
            "description": "Bad bot: BuzzSumo",
            "version": "1.0",
            "score": 90,
            "action": "block",
            "whitelist": 0
        },
        {
            "rule_id": "badbot-5882f37e",
            "enabled": 1,
            "category": "SCANNER",
            "severity": 1,
            "pattern": "/Ai2Bot/i",
            "description": "Bad bot: Ai2Bot",
            "version": "1.0",
            "score": 90,
            "action": "block",
            "whitelist": 0
        },
        {
            "rule_id": "badbot-5c5fec80",
            "enabled": 1,
            "category": "SCANNER",
            "severity": 1,
            "pattern": "/Brandwatch/i",
            "description": "Bad bot: Brandwatch",
            "version": "1.0",
            "score": 90,
            "action": "block",
            "whitelist": 0
        },
        {
            "rule_id": "badbot-6296b939",
            "enabled": 1,
            "category": "SCANNER",
            "severity": 1,
            "pattern": "/AlphaBot/i",
            "description": "Bad bot: AlphaBot",
            "version": "1.0",
            "score": 90,
            "action": "block",
            "whitelist": 0
        },
        {
            "rule_id": "badbot-65d1ec29",
            "enabled": 1,
            "category": "SCANNER",
            "severity": 1,
            "pattern": "/CensysInspect/i",
            "description": "Bad bot: CensysInspect",
            "version": "1.0",
            "score": 90,
            "action": "block",
            "whitelist": 0
        },
        {
            "rule_id": "badbot-66f02134",
            "enabled": 1,
            "category": "SCANNER",
            "severity": 1,
            "pattern": "/AhrefsBot/i",
            "description": "Bad bot: AhrefsBot",
            "version": "1.0",
            "score": 90,
            "action": "block",
            "whitelist": 0
        },
        {
            "rule_id": "badbot-6a956604",
            "enabled": 1,
            "category": "SCANNER",
            "severity": 1,
            "pattern": "/Cegbfeieh/i",
            "description": "Bad bot: Cegbfeieh",
            "version": "1.0",
            "score": 90,
            "action": "block",
            "whitelist": 0
        },
        {
            "rule_id": "badbot-6c8e5568",
            "enabled": 1,
            "category": "SCANNER",
            "severity": 1,
            "pattern": "/AdsTxtCrawlerTP/i",
            "description": "Bad bot: AdsTxtCrawlerTP",
            "version": "1.0",
            "score": 90,
            "action": "block",
            "whitelist": 0
        },
        {
            "rule_id": "badbot-6da1575a",
            "enabled": 1,
            "category": "SCANNER",
            "severity": 1,
            "pattern": "/ClaudeBot/i",
            "description": "Bad bot: ClaudeBot",
            "version": "1.0",
            "score": 90,
            "action": "block",
            "whitelist": 0
        },
        {
            "rule_id": "badbot-6edb07ad",
            "enabled": 1,
            "category": "SCANNER",
            "severity": 1,
            "pattern": "/BuiltWith/i",
            "description": "Bad bot: BuiltWith",
            "version": "1.0",
            "score": 90,
            "action": "block",
            "whitelist": 0
        },
        {
            "rule_id": "badbot-6f0fcc71",
            "enabled": 1,
            "category": "SCANNER",
            "severity": 1,
            "pattern": "/AwarioSmartBot/i",
            "description": "Bad bot: AwarioSmartBot",
            "version": "1.0",
            "score": 90,
            "action": "block",
            "whitelist": 0
        },
        {
            "rule_id": "badbot-6fabb7e3",
            "enabled": 1,
            "category": "SCANNER",
            "severity": 1,
            "pattern": "/BacklinkCrawler/i",
            "description": "Bad bot: BacklinkCrawler",
            "version": "1.0",
            "score": 90,
            "action": "block",
            "whitelist": 0
        },
        {
            "rule_id": "badbot-7193518e",
            "enabled": 1,
            "category": "SCANNER",
            "severity": 1,
            "pattern": "/Attach/i",
            "description": "Bad bot: Attach",
            "version": "1.0",
            "score": 90,
            "action": "block",
            "whitelist": 0
        },
        {
            "rule_id": "badbot-7534759c",
            "enabled": 1,
            "category": "SCANNER",
            "severity": 1,
            "pattern": "/Bandit/i",
            "description": "Bad bot: Bandit",
            "version": "1.0",
            "score": 90,
            "action": "block",
            "whitelist": 0
        },
        {
            "rule_id": "badbot-77a3297a",
            "enabled": 1,
            "category": "SCANNER",
            "severity": 1,
            "pattern": "/Calculon/i",
            "description": "Bad bot: Calculon",
            "version": "1.0",
            "score": 90,
            "action": "block",
            "whitelist": 0
        },
        {
            "rule_id": "badbot-7af1faa0",
            "enabled": 1,
            "category": "SCANNER",
            "severity": 1,
            "pattern": "/Aliyun/i",
            "description": "Bad bot: Aliyun",
            "version": "1.0",
            "score": 90,
            "action": "block",
            "whitelist": 0
        },
        {
            "rule_id": "badbot-7d2a4a30",
            "enabled": 1,
            "category": "SCANNER",
            "severity": 1,
            "pattern": "/BlackWidow/i",
            "description": "Bad bot: BlackWidow",
            "version": "1.0",
            "score": 90,
            "action": "block",
            "whitelist": 0
        },
        {
            "rule_id": "badbot-7de85f3c",
            "enabled": 1,
            "category": "SCANNER",
            "severity": 1,
            "pattern": "/BacklinksExtendedBot/i",
            "description": "Bad bot: BacklinksExtendedBot",
            "version": "1.0",
            "score": 90,
            "action": "block",
            "whitelist": 0
        },
        {
            "rule_id": "badbot-7e7a0c1e",
            "enabled": 1,
            "category": "SCANNER",
            "severity": 1,
            "pattern": "/ADmantX/i",
            "description": "Bad bot: ADmantX",
            "version": "1.0",
            "score": 90,
            "action": "block",
            "whitelist": 0
        },
        {
            "rule_id": "badbot-81e133f3",
            "enabled": 1,
            "category": "SCANNER",
            "severity": 1,
            "pattern": "/BlowFish/i",
            "description": "Bad bot: BlowFish",
            "version": "1.0",
            "score": 90,
            "action": "block",
            "whitelist": 0
        },
        {
            "rule_id": "badbot-846edc53",
            "enabled": 1,
            "category": "SCANNER",
            "severity": 1,
            "pattern": "/AIBOT/i",
            "description": "Bad bot: AIBOT",
            "version": "1.0",
            "score": 90,
            "action": "block",
            "whitelist": 0
        },
        {
            "rule_id": "badbot-8be027b1",
            "enabled": 1,
            "category": "SCANNER",
            "severity": 1,
            "pattern": "/Bolt/i",
            "description": "Bad bot: Bolt",
            "version": "1.0",
            "score": 90,
            "action": "block",
            "whitelist": 0
        },
        {
            "rule_id": "badbot-8fb645e2",
            "enabled": 1,
            "category": "SCANNER",
            "severity": 1,
            "pattern": "/Buddy/i",
            "description": "Bad bot: Buddy",
            "version": "1.0",
            "score": 90,
            "action": "block",
            "whitelist": 0
        },
        {
            "rule_id": "badbot-8fc330d7",
            "enabled": 1,
            "category": "SCANNER",
            "severity": 1,
            "pattern": "/Collector/i",
            "description": "Bad bot: Collector",
            "version": "1.0",
            "score": 90,
            "action": "block",
            "whitelist": 0
        },
        {
            "rule_id": "badbot-90cb709b",
            "enabled": 1,
            "category": "SCANNER",
            "severity": 1,
            "pattern": "/AwarioBot/i",
            "description": "Bad bot: AwarioBot",
            "version": "1.0",
            "score": 90,
            "action": "block",
            "whitelist": 0
        },
        {
            "rule_id": "badbot-95af4a05",
            "enabled": 1,
            "category": "SCANNER",
            "severity": 1,
            "pattern": "/BunnySlippers/i",
            "description": "Bad bot: BunnySlippers",
            "version": "1.0",
            "score": 90,
            "action": "block",
            "whitelist": 0
        },
        {
            "rule_id": "badbot-9c91554d",
            "enabled": 1,
            "category": "SCANNER",
            "severity": 1,
            "pattern": "/404checker/i",
            "description": "Bad bot: 404checker",
            "version": "1.0",
            "score": 90,
            "action": "block",
            "whitelist": 0
        },
        {
            "rule_id": "badbot-a04200a5",
            "enabled": 1,
            "category": "SCANNER",
            "severity": 1,
            "pattern": "/Barkrowler/i",
            "description": "Bad bot: Barkrowler",
            "version": "1.0",
            "score": 90,
            "action": "block",
            "whitelist": 0
        },
        {
            "rule_id": "badbot-a657ad66",
            "enabled": 1,
            "category": "SCANNER",
            "severity": 1,
            "pattern": "/Chlooe/i",
            "description": "Bad bot: Chlooe",
            "version": "1.0",
            "score": 90,
            "action": "block",
            "whitelist": 0
        },
        {
            "rule_id": "badbot-a6662ec1",
            "enabled": 1,
            "category": "SCANNER",
            "severity": 1,
            "pattern": "/ChatGPT\\-User/i",
            "description": "Bad bot: ChatGPT-User",
            "version": "1.0",
            "score": 90,
            "action": "block",
            "whitelist": 0
        },
        {
            "rule_id": "badbot-a8d40e2d",
            "enabled": 1,
            "category": "SCANNER",
            "severity": 1,
            "pattern": "/CazoodleBot/i",
            "description": "Bad bot: CazoodleBot",
            "version": "1.0",
            "score": 90,
            "action": "block",
            "whitelist": 0
        },
        {
            "rule_id": "badbot-a935dbef",
            "enabled": 1,
            "category": "SCANNER",
            "severity": 1,
            "pattern": "/Anarchie/i",
            "description": "Bad bot: Anarchie",
            "version": "1.0",
            "score": 90,
            "action": "block",
            "whitelist": 0
        },
        {
            "rule_id": "badbot-aa26a513",
            "enabled": 1,
            "category": "SCANNER",
            "severity": 1,
            "pattern": "/Badass/i",
            "description": "Bad bot: Badass",
            "version": "1.0",
            "score": 90,
            "action": "block",
            "whitelist": 0
        },
        {
            "rule_id": "badbot-aaa52050",
            "enabled": 1,
            "category": "SCANNER",
            "severity": 1,
            "pattern": "/01h4x\\.com/i",
            "description": "Bad bot: 01h4x.com",
            "version": "1.0",
            "score": 90,
            "action": "block",
            "whitelist": 0
        },
        {
            "rule_id": "badbot-adeccf88",
            "enabled": 1,
            "category": "SCANNER",
            "severity": 1,
            "pattern": "/Blow/i",
            "description": "Bad bot: Blow",
            "version": "1.0",
            "score": 90,
            "action": "block",
            "whitelist": 0
        },
        {
            "rule_id": "badbot-b7eda74b",
            "enabled": 1,
            "category": "SCANNER",
            "severity": 1,
            "pattern": "/AwarioRssBot/i",
            "description": "Bad bot: AwarioRssBot",
            "version": "1.0",
            "score": 90,
            "action": "block",
            "whitelist": 0
        },
        {
            "rule_id": "badbot-b84c4cc5",
            "enabled": 1,
            "category": "SCANNER",
            "severity": 1,
            "pattern": "/Apexoo/i",
            "description": "Bad bot: Apexoo",
            "version": "1.0",
            "score": 90,
            "action": "block",
            "whitelist": 0
        },
        {
            "rule_id": "badbot-b84e3e85",
            "enabled": 1,
            "category": "SCANNER",
            "severity": 1,
            "pattern": "/Copier/i",
            "description": "Bad bot: Copier",
            "version": "1.0",
            "score": 90,
            "action": "block",
            "whitelist": 0
        },
        {
            "rule_id": "badbot-b8f6423e",
            "enabled": 1,
            "category": "SCANNER",
            "severity": 1,
            "pattern": "/Copyscape/i",
            "description": "Bad bot: Copyscape",
            "version": "1.0",
            "score": 90,
            "action": "block",
            "whitelist": 0
        },
        {
            "rule_id": "badbot-b9157966",
            "enabled": 1,
            "category": "SCANNER",
            "severity": 1,
            "pattern": "/BLEXBot/i",
            "description": "Bad bot: BLEXBot",
            "version": "1.0",
            "score": 90,
            "action": "block",
            "whitelist": 0
        },
        {
            "rule_id": "badbot-baadfe27",
            "enabled": 1,
            "category": "SCANNER",
            "severity": 1,
            "pattern": "/80legs/i",
            "description": "Bad bot: 80legs",
            "version": "1.0",
            "score": 90,
            "action": "block",
            "whitelist": 0
        },
        {
            "rule_id": "badbot-bb5af796",
            "enabled": 1,
            "category": "SCANNER",
            "severity": 1,
            "pattern": "/Aspiegel/i",
            "description": "Bad bot: Aspiegel",
            "version": "1.0",
            "score": 90,
            "action": "block",
            "whitelist": 0
        },
        {
            "rule_id": "badbot-bc95c07e",
            "enabled": 1,
            "category": "SCANNER",
            "severity": 1,
            "pattern": "/CopyRightCheck/i",
            "description": "Bad bot: CopyRightCheck",
            "version": "1.0",
            "score": 90,
            "action": "block",
            "whitelist": 0
        },
        {
            "rule_id": "badbot-bda43712",
            "enabled": 1,
            "category": "SCANNER",
            "severity": 1,
            "pattern": "/CheeseBot/i",
            "description": "Bad bot: CheeseBot",
            "version": "1.0",
            "score": 90,
            "action": "block",
            "whitelist": 0
        },
        {
            "rule_id": "badbot-c03fd51e",
            "enabled": 1,
            "category": "SCANNER",
            "severity": 1,
            "pattern": "/BuiltBotTough/i",
            "description": "Bad bot: BuiltBotTough",
            "version": "1.0",
            "score": 90,
            "action": "block",
            "whitelist": 0
        },
        {
            "rule_id": "badbot-c189e9d6",
            "enabled": 1,
            "category": "SCANNER",
            "severity": 1,
            "pattern": "/Asterias/i",
            "description": "Bad bot: Asterias",
            "version": "1.0",
            "score": 90,
            "action": "block",
            "whitelist": 0
        },
        {
            "rule_id": "badbot-c34631f4",
            "enabled": 1,
            "category": "SCANNER",
            "severity": 1,
            "pattern": "/Bullseye/i",
            "description": "Bad bot: Bullseye",
            "version": "1.0",
            "score": 90,
            "action": "block",
            "whitelist": 0
        },
        {
            "rule_id": "badbot-c4e49356",
            "enabled": 1,
            "category": "SCANNER",
            "severity": 1,
            "pattern": "/Bytespider/i",
            "description": "Bad bot: Bytespider",
            "version": "1.0",
            "score": 90,
            "action": "block",
            "whitelist": 0
        },
        {
            "rule_id": "badbot-c5c7f40b",
            "enabled": 1,
            "category": "SCANNER",
            "severity": 1,
            "pattern": "/ASPSeek/i",
            "description": "Bad bot: ASPSeek",
            "version": "1.0",
            "score": 90,
            "action": "block",
            "whitelist": 0
        },
        {
            "rule_id": "badbot-c64ae6ad",
            "enabled": 1,
            "category": "SCANNER",
            "severity": 1,
            "pattern": "/Citoid/i",
            "description": "Bad bot: Citoid",
            "version": "1.0",
            "score": 90,
            "action": "block",
            "whitelist": 0
        },
        {
            "rule_id": "badbot-c8ad62d8",
            "enabled": 1,
            "category": "SCANNER",
            "severity": 1,
            "pattern": "/ChinaClaw/i",
            "description": "Bad bot: ChinaClaw",
            "version": "1.0",
            "score": 90,
            "action": "block",
            "whitelist": 0
        },
        {
            "rule_id": "badbot-c9ec0bf5",
            "enabled": 1,
            "category": "SCANNER",
            "severity": 1,
            "pattern": "/AllSubmitter/i",
            "description": "Bad bot: AllSubmitter",
            "version": "1.0",
            "score": 90,
            "action": "block",
            "whitelist": 0
        },
        {
            "rule_id": "badbot-ccac02ce",
            "enabled": 1,
            "category": "SCANNER",
            "severity": 1,
            "pattern": "/AliyunSecBot/i",
            "description": "Bad bot: AliyunSecBot",
            "version": "1.0",
            "score": 90,
            "action": "block",
            "whitelist": 0
        },
        {
            "rule_id": "badbot-ccb2293e",
            "enabled": 1,
            "category": "SCANNER",
            "severity": 1,
            "pattern": "/BackStreet/i",
            "description": "Bad bot: BackStreet",
            "version": "1.0",
            "score": 90,
            "action": "block",
            "whitelist": 0
        },
        {
            "rule_id": "badbot-cea4c361",
            "enabled": 1,
            "category": "SCANNER",
            "severity": 1,
            "pattern": "/CODE87/i",
            "description": "Bad bot: CODE87",
            "version": "1.0",
            "score": 90,
            "action": "block",
            "whitelist": 0
        },
        {
            "rule_id": "badbot-d19a10d6",
            "enabled": 1,
            "category": "SCANNER",
            "severity": 1,
            "pattern": "/Anarchy99/i",
            "description": "Bad bot: Anarchy99",
            "version": "1.0",
            "score": 90,
            "action": "block",
            "whitelist": 0
        },
        {
            "rule_id": "badbot-d2fa5296",
            "enabled": 1,
            "category": "SCANNER",
            "severity": 1,
            "pattern": "/Cocolyzebot/i",
            "description": "Bad bot: Cocolyzebot",
            "version": "1.0",
            "score": 90,
            "action": "block",
            "whitelist": 0
        },
        {
            "rule_id": "badbot-d7f1bb86",
            "enabled": 1,
            "category": "SCANNER",
            "severity": 1,
            "pattern": "/BDCbot/i",
            "description": "Bad bot: BDCbot",
            "version": "1.0",
            "score": 90,
            "action": "block",
            "whitelist": 0
        },
        {
            "rule_id": "badbot-dc519b6b",
            "enabled": 1,
            "category": "SCANNER",
            "severity": 1,
            "pattern": "/Cogentbot/i",
            "description": "Bad bot: Cogentbot",
            "version": "1.0",
            "score": 90,
            "action": "block",
            "whitelist": 0
        },
        {
            "rule_id": "badbot-dc52c031",
            "enabled": 1,
            "category": "SCANNER",
            "severity": 1,
            "pattern": "/BatchFTP/i",
            "description": "Bad bot: BatchFTP",
            "version": "1.0",
            "score": 90,
            "action": "block",
            "whitelist": 0
        },
        {
            "rule_id": "badbot-dd01386c",
            "enabled": 1,
            "category": "SCANNER",
            "severity": 1,
            "pattern": "/Abonti/i",
            "description": "Bad bot: Abonti",
            "version": "1.0",
            "score": 90,
            "action": "block",
            "whitelist": 0
        },
        {
            "rule_id": "badbot-dd1ef49e",
            "enabled": 1,
            "category": "SCANNER",
            "severity": 1,
            "pattern": "/BetaBot/i",
            "description": "Bad bot: BetaBot",
            "version": "1.0",
            "score": 90,
            "action": "block",
            "whitelist": 0
        },
        {
            "rule_id": "badbot-dd78f216",
            "enabled": 1,
            "category": "SCANNER",
            "severity": 1,
            "pattern": "/Aboundex/i",
            "description": "Bad bot: Aboundex",
            "version": "1.0",
            "score": 90,
            "action": "block",
            "whitelist": 0
        },
        {
            "rule_id": "badbot-de619213",
            "enabled": 1,
            "category": "SCANNER",
            "severity": 1,
            "pattern": "/404enemy/i",
            "description": "Bad bot: 404enemy",
            "version": "1.0",
            "score": 90,
            "action": "block",
            "whitelist": 0
        },
        {
            "rule_id": "badbot-e27c35ae",
            "enabled": 1,
            "category": "SCANNER",
            "severity": 1,
            "pattern": "/Bigfoot/i",
            "description": "Bad bot: Bigfoot",
            "version": "1.0",
            "score": 90,
            "action": "block",
            "whitelist": 0
        },
        {
            "rule_id": "badbot-e28fb219",
            "enabled": 1,
            "category": "SCANNER",
            "severity": 1,
            "pattern": "/Ankit/i",
            "description": "Bad bot: Ankit",
            "version": "1.0",
            "score": 90,
            "action": "block",
            "whitelist": 0
        },
        {
            "rule_id": "badbot-e8b84b9b",
            "enabled": 1,
            "category": "SCANNER",
            "severity": 1,
            "pattern": "/BackWeb/i",
            "description": "Bad bot: BackWeb",
            "version": "1.0",
            "score": 90,
            "action": "block",
            "whitelist": 0
        },
        {
            "rule_id": "badbot-e9daa003",
            "enabled": 1,
            "category": "SCANNER",
            "severity": 1,
            "pattern": "/AiHitBot/i",
            "description": "Bad bot: AiHitBot",
            "version": "1.0",
            "score": 90,
            "action": "block",
            "whitelist": 0
        },
        {
            "rule_id": "badbot-ebc678c5",
            "enabled": 1,
            "category": "SCANNER",
            "severity": 1,
            "pattern": "/Claritybot/i",
            "description": "Bad bot: Claritybot",
            "version": "1.0",
            "score": 90,
            "action": "block",
            "whitelist": 0
        },
        {
            "rule_id": "badbot-ee75f2f5",
            "enabled": 1,
            "category": "SCANNER",
            "severity": 1,
            "pattern": "/Acunetix/i",
            "description": "Bad bot: Acunetix",
            "version": "1.0",
            "score": 90,
            "action": "block",
            "whitelist": 0
        },
        {
            "rule_id": "badbot-eef266b4",
            "enabled": 1,
            "category": "SCANNER",
            "severity": 1,
            "pattern": "/Cloud\\\\\\ mapping/i",
            "description": "Bad bot: Cloud\\ mapping",
            "version": "1.0",
            "score": 90,
            "action": "block",
            "whitelist": 0
        },
        {
            "rule_id": "badbot-f213d5db",
            "enabled": 1,
            "category": "SCANNER",
            "severity": 1,
            "pattern": "/BotALot/i",
            "description": "Bad bot: BotALot",
            "version": "1.0",
            "score": 90,
            "action": "block",
            "whitelist": 0
        },
        {
            "rule_id": "badbot-f2c2fd00",
            "enabled": 1,
            "category": "SCANNER",
            "severity": 1,
            "pattern": "/Anthill/i",
            "description": "Bad bot: Anthill",
            "version": "1.0",
            "score": 90,
            "action": "block",
            "whitelist": 0
        },
        {
            "rule_id": "badbot-f2da8690",
            "enabled": 1,
            "category": "SCANNER",
            "severity": 1,
            "pattern": "/Battleztar\\\\\\ Bazinga/i",
            "description": "Bad bot: Battleztar\\ Bazinga",
            "version": "1.0",
            "score": 90,
            "action": "block",
            "whitelist": 0
        },
        {
            "rule_id": "badbot-fec4b3ac",
            "enabled": 1,
            "category": "SCANNER",
            "severity": 1,
            "pattern": "/BackDoorBot/i",
            "description": "Bad bot: BackDoorBot",
            "version": "1.0",
            "score": 90,
            "action": "block",
            "whitelist": 0
        },
        {
            "rule_id": "xss-001",
            "enabled": 1,
            "category": "XSS",
            "severity": 3,
            "pattern": "/<script[^>]*>.*?<\\/script>/i",
            "description": "Detects script tags",
            "version": "1.0",
            "score": 50,
            "action": "block",
            "whitelist": 0
        },
        {
            "rule_id": "xss-002",
            "enabled": 1,
            "category": "XSS",
            "severity": 3,
            "pattern": "/on(load|unload|error|abort|click|dblclick|mouse(down|up|over|out|enter|leave|move)|focus|blur|change|submit|reset|select|keypress|keydown|keyup|contextmenu|drag|drop|copy|cut|paste|scroll|resize|beforeunload)[\\s]*=/i",
            "description": "Detects inline event handlers",
            "version": "1.0",
            "score": 50,
            "action": "block",
            "whitelist": 0
        },
        {
            "rule_id": "xss-003",
            "enabled": 1,
            "category": "XSS",
            "severity": 4,
            "pattern": "/javascript\\s*:/i",
            "description": "Detects javascript: protocol",
            "version": "1.0",
            "score": 60,
            "action": "block",
            "whitelist": 0
        },
        {
            "rule_id": "xss-004",
            "enabled": 1,
            "category": "XSS",
            "severity": 4,
            "pattern": "/vbscript\\s*:/i",
            "description": "Detects vbscript: protocol",
            "version": "1.0",
            "score": 60,
            "action": "block",
            "whitelist": 0
        },
        {
            "rule_id": "xss-005",
            "enabled": 1,
            "category": "XSS",
            "severity": 4,
            "pattern": "/data\\s*:[^,]*;base64/i",
            "description": "Detects data: protocol with base64",
            "version": "1.0",
            "score": 60,
            "action": "block",
            "whitelist": 0
        },
        {
            "rule_id": "xss-006",
            "enabled": 1,
            "category": "XSS",
            "severity": 3,
            "pattern": "/<iframe[^>]*>/i",
            "description": "Detects iframe tags",
            "version": "1.0",
            "score": 50,
            "action": "block",
            "whitelist": 0
        },
        {
            "rule_id": "xss-007",
            "enabled": 1,
            "category": "XSS",
            "severity": 3,
            "pattern": "/<object[^>]*>/i",
            "description": "Detects object tags",
            "version": "1.0",
            "score": 50,
            "action": "block",
            "whitelist": 0
        },
        {
            "rule_id": "xss-008",
            "enabled": 1,
            "category": "XSS",
            "severity": 3,
            "pattern": "/<embed[^>]*>/i",
            "description": "Detects embed tags",
            "version": "1.0",
            "score": 50,
            "action": "block",
            "whitelist": 0
        },
        {
            "rule_id": "xss-009",
            "enabled": 1,
            "category": "XSS",
            "severity": 4,
            "pattern": "/expression\\s*\\(/i",
            "description": "Detects CSS expression() function",
            "version": "1.0",
            "score": 60,
            "action": "block",
            "whitelist": 0
        },
        {
            "rule_id": "xss-010",
            "enabled": 1,
            "category": "XSS",
            "severity": 4,
            "pattern": "/behavior\\s*:/i",
            "description": "Detects CSS behavior property",
            "version": "1.0",
            "score": 60,
            "action": "block",
            "whitelist": 0
        },
        {
            "rule_id": "sqli-001",
            "enabled": 1,
            "category": "SQLI",
            "severity": 4,
            "pattern": "/union[\\s]+select/i",
            "description": "Detects UNION SELECT statements",
            "version": "1.0",
            "score": 50,
            "action": "block",
            "whitelist": 0
        },
        {
            "rule_id": "sqli-002",
            "enabled": 1,
            "category": "SQLI",
            "severity": 3,
            "pattern": "/(' or '1'='1|\" or \"1\"=\"1|or 1=1)/i",
            "description": "Detects SQL tautology",
            "version": "1.0",
            "score": 50,
            "action": "block",
            "whitelist": 0
        },
        {
            "rule_id": "sqli-003",
            "enabled": 1,
            "category": "SQLI",
            "severity": 4,
            "pattern": "/(select|insert|update|delete|drop|create|alter)[\\s]+.*(from|into|table|database)/i",
            "description": "Detects SQL command patterns",
            "version": "1.0",
            "score": 60,
            "action": "block",
            "whitelist": 0
        },
        {
            "rule_id": "sqli-004",
            "enabled": 1,
            "category": "SQLI",
            "severity": 3,
            "pattern": "/--[\\s]*$/",
            "description": "Detects SQL comment syntax",
            "version": "1.0",
            "score": 40,
            "action": "block",
            "whitelist": 0
        },
        {
            "rule_id": "rfi-001",
            "enabled": 1,
            "category": "RFI",
            "severity": 4,
            "pattern": "/(http|https|ftp):\\/\\/[^\\s]+(\\.php|\\.txt|\\.js)/i",
            "description": "Detects remote file inclusion",
            "version": "1.0",
            "score": 50,
            "action": "block",
            "whitelist": 0
        },
        {
            "rule_id": "lfi-002",
            "enabled": 1,
            "category": "LFI",
            "severity": 4,
            "pattern": "/\\/(etc\\/passwd|proc\\/self|windows\\/system32)/i",
            "description": "Detects system file access attempts",
            "version": "1.0",
            "score": 60,
            "action": "block",
            "whitelist": 0
        },
        {
            "rule_id": "rce-001",
            "enabled": 1,
            "category": "RCE",
            "severity": 5,
            "pattern": "/(exec|shell_exec|system|passthru|eval|base64_decode|assert|popen)[\\s]*\\(/i",
            "description": "Detects command execution functions",
            "version": "1.0",
            "score": 60,
            "action": "block",
            "whitelist": 0
        },
        {
            "rule_id": "rce-002",
            "enabled": 1,
            "category": "RCE",
            "severity": 5,
            "pattern": "/\\$_(GET|POST|REQUEST|COOKIE)\\[.*?\\].*?\\(/i",
            "description": "Detects potential variable function execution",
            "version": "1.0",
            "score": 50,
            "action": "block",
            "whitelist": 0
        },
        {
            "rule_id": "upload-001",
            "enabled": 1,
            "category": "FILE_UPLOAD",
            "severity": 4,
            "pattern": "/\\.(php|phtml|php3|php4|php5|phar|exe|sh|bat|cmd)$/i",
            "description": "Detects dangerous file extensions",
            "version": "1.0",
            "score": 70,
            "action": "block",
            "whitelist": 0
        },
        {
            "rule_id": "scanner-001",
            "enabled": 1,
            "category": "SCANNER",
            "severity": 2,
            "pattern": "/(nikto|nmap|sqlmap|acunetix|nessus|openvas|burp)/i",
            "description": "Detects security scanner user agents",
            "version": "1.0",
            "score": 30,
            "action": "log",
            "whitelist": 0
        }
    ]
}