How do I report malicious requests coming through WAF?

Question

I've seen some malicious requests that are slipping through WAF, they have a pattern (as in the urls requested are random, but many end with .htm) and are generating 404 errors, but they are still coming through WAF.
They are all from different IP addresses.
I will add a custom filter but is there a recommended way to report these to the WAF team?

elochime · Accepted Answer

To report malicious requests coming through AWS WAF (Web Application Firewall), you can follow these steps:

- Document the pattern: Collect detailed information about the malicious requests, including URLs, IP addresses, and any other relevant data.

- Implement custom rules: As you mentioned, create a custom rule in WAF to block these requests based on the pattern you've observed (e.g., URLs ending with .htm).

- Use AWS Shield: If you're not already using it, consider enabling AWS Shield Advanced for additional protection against DDoS attacks and other sophisticated threats.

- Monitor and log: Utilize AWS WAF logs and Amazon CloudWatch to monitor and analyze the traffic patterns.

- Report to AWS: To report these malicious requests to the AWS WAF team:

- Open a support case through the AWS Support Center
     - Choose "WAF" as the service
     - Provide a detailed description of the issue, including logs and patterns
     - Select "Security Issue" as the issue type.

- Collaborate with AWS: Work with AWS support to fine-tune your WAF rules and discuss potential improvements to the service.

- Consider using AWS Managed Rules: AWS provides a set of managed rules that are regularly updated to protect against common threats. These might help catch some of the malicious requests you're seeing.
https://docs.aws.amazon.com/waf/latest/developerguide/waf-rule-statement-type-regex-pattern-set-match.html
https://docs.aws.amazon.com/waf/latest/developerguide/shield-chapter.html

Tati Hana · Answer

Thank you for the answer! I have documented the pattern and created a custom rule to block, and interestingly, after I added the rule and it started blocking requests, the attackers got much more aggressive (went from one request every 10 minutes getting through to a dozen requests per minute that are now being blocked).

We're not using shield. I think we've looked into this a few months back and at the time the cost was too much for us.

I tried to open a support ticket, but unfortunately our tier doesn't include business support for technical tickets.

We're already using AWS Managed Rules. Here's the list of rules we have active these didn't stop the malicious requests:

* AWS-AWSManagedRulesAmazonIpReputationList
* AWS-AWSManagedRulesAnonymousIpList
* AWS-AWSManagedRulesCommonRuleSet
* AWS-AWSManagedRulesKnownBadInputsRuleSet
* AWS-AWSManagedRulesLinuxRuleSet
* AWS-AWSManagedRulesUnixRuleSet
* AWS-AWSManagedRulesSQLiRuleSet
* AWS-AWSManagedRulesWordPressRuleSet
* AWS-AWSManagedRulesWindowsRuleSet
* AWS-AWSManagedRulesPHPRuleSet
* AWS-AWSManagedRulesBotControlRuleSet

I'm not sure if there are more requests that are getting through, other than the ones I noticed because they generated a 404 on my application.

Edit: I've found how they are getting the "randomness" of the requests, looks like they scrapped a bunch of URLs from an assisted living website that generates slugified URLs and they just spam requests using those paths against our site. It's actually pretty clever. Not sure what these people are trying to accomplish though. Maybe just testing the waters for DDoS attacks?

How do I report malicious requests coming through WAF?

Add your answer

Relevant content