Home › Docs ›Detection › Detection Capabilities

Detection Capabilities

What the system can detect and how it identifies malicious activity

Capability Summary

The system provides detection coverage across multiple analytical layers, implemented across pattern_rules.lua, vulnerability_rules.lua, suricata_rules.lua, abuseipdb_rules.lua, session_rules.lua, upload_rules.lua, admin_rules.lua, and sophistication_analyzer.lua.

Signal Families

pattern_rules Request shape Generic and specific URI patterns, URL-encoding evasion, parameter pollution, request methods and header anomalies. +5 … +80 per match

vulnerability_rules Known vulnerabilities Exact matching of seeded CVE exploit signatures against the URI, query arguments and required headers. +40 per CVE

suricata_rules Network evidence eve.json alert extraction, severity mapping, private-address filtering and time-decayed reputation. +10 … +50 per alert

session_rules · admin_rules Session behaviour Brute force, repeated admin attempts, automation fingerprints, request-rate streaks and cumulative suspicion. Thresholds and streaks

upload_rules · honeytoken_rules Uploads and tokens AJAX upload analysis, dangerous content types and detection of injected fake credentials appearing inbound. High-confidence signals

abuseipdb_rules Reportability Deterministic mapping from routing reasons to AbuseIPDB categories, with matched CVEs in the report comment. 6 reason types

Capability	Technique	Module	Description
Direct CVE Matching	Lua URI/argument patterns	vulnerability_rules.lua	Exact matching of seeded CVE exploit signatures
Generic Attack Patterns	Lua pattern signatures	pattern_rules.lua	Heuristic coverage for SQLi, XSS, C2, injection, traversal, upload abuse
Network IDS	Suricata signatures	suricata_rules.lua	Alert-based detection correlated via suricata_rules
Behavioral Signals	Brute force, automation, anomalies	session_rules.lua	Session anomaly detection, automation detection via UA fingerprint and timing
Reportability	AbuseIPDB mapping	abuseipdb_rules.lua	Deterministic gating and comment enrichment with matched CVEs
Sophistication Classification	Weighted rule set	sophistication_analyzer.lua	Classifies traffic as scripted / ai_assisted / manual / unknown
Honeytoken Detection	Token corpus scanning	honeytoken_handler.lua	Detects when injected fake credentials appear in inbound requests

Detection Techniques

Pattern Matching

Generic patterns: Layer 1 entries in pattern_rules.SUSPICIOUS_PATTERNS — each entry declares how it matches (plain, ext, param, segment, pat). Matches add +15 per entry.
Specific checks: Layer 2 in pattern_rules.analyze_uri_patterns() with per-pattern scores (directory traversal +20, SQL drop +30, wp-config.bak +80).
URL encoding evasion: +10 when percent-encoding is detected in the URI.
HTTP Parameter Pollution: +15 when more than 20 parameters are present.

Header Analysis

Flagged User-Agents: +50 for known automation/scanner tools (sqlmap, nmap, masscan, zap, acunetix, nikto, dirb, gobuster, wpscan, whatweb, nuclei, burpsuite, havij, pangolin).
Missing User-Agent: +10 — legitimate browsers always send one.
CVE-2023-28121 header: +50 when X-WCPAY-PLATFORM-CHECKOUT-USER is present.
Missing Referer on POST: +5 (WSTG-ATHN-04).
HTTP Basic Authentication probe: +5.

Layer-1 entries in pattern_rules.lua name their match kind explicitly instead of relying on bare Lua patterns, where . and - are operators and once made per_page=100 score +65:

local function plain(s) return { kind = "plain", match = s, name = s } end
local function ext(e) return { kind = "ext", match = e, name = e } end
local function param(n) return { kind = "param", match = n, name = n .. "=" } end
local function segment(s) return { kind = "segment", match = s, name = s } end
local function pat(p, name) return { kind = "pattern", match = p, name = name } end

_M.SUSPICIOUS_PATTERNS = {
    -- WSTG-INPV-01: Directory traversal
    plain("../"), plain("..\\"),

    -- WSTG-INPV-05: SQL injection (real syntax, word boundaries)
    pat("union[^%a].-select[^%a]", "union.*select"),
    pat("sleep%s*%(", "sleep"),

    -- WSTG-INPV-12: Command injection
    pat(";%s*cat[%s%+]", ";cat"),

    -- WSTG-CONF: Sensitive file access
    plain("wp-config.php"), ext(".env"), segment("/backup"),
    -- ...

CVE Pattern Matching

pattern_rules.analyze_cve_patterns() checks URI, query string, and headers against _G.config.vulnerability.cve_patterns. Each match scores +40. See Seeded CVEs for the full list.

Function Reference

Function	Module	Contract
`analyze_uri_patterns(uri, args)`	pattern_rules.lua	Returns a score delta plus the list of matched pattern names.
`analyze_header_patterns(headers)`	pattern_rules.lua	Scores flagged or missing headers and CVE-specific header presence.
`analyze_cve_patterns(uri, args, headers)`	pattern_rules.lua	Matches `config.vulnerability.cve_patterns`; +40 per CVE.
`detect_vulnerability_pattern(uri, args, header)`	vulnerability_rules.lua	Returns `cve`, `severity`, `description`, `plugin` and `attack_vector`.
`extract_alert(decoded)`	suricata_rules.lua	Alert record, or `nil` for non-alert and malformed events.
`severity_to_score(severity)`	suricata_rules.lua	1 → +50, 2 → +25, anything else → +10.
`is_reportable_reason(reason)`	abuseipdb_rules.lua	True only for the six whitelisted routing reasons.
`classify_session(session)`	sophistication_analyzer.lua	Class plus confidence for scripted / AI-assisted / manual / unknown.

Individual module pages in the repository contain the complete function-level comments and their unit tests. The testing section lists the test file for each module.

Honest Assessment

Strengths: Explainable scoring, pure/adapter split for unit testing, severity-graded Suricata integration, NAT protection, sophistication classification, five honeytoken types and a consent-gated device signature that survives a cookie wipe. A recorded exploit test-scenario run diverted 13/14 CVE exploits (and 14/16 plugin/theme targets) on the first request with no honeypot bypasses once routed — see Validation Results.

Limitations: Same-host Suricata testing gap, threshold tuning needed for legitimate API clients, generic pattern false positives (historical), no ML.