AWS Managed Rules changelog - AWS WAF, AWS Firewall Manager, and AWS Shield Advanced

AWS Managed Rules changelog

This section lists changes to the AWS Managed Rules for AWS WAF since their release in November, 2019.

Note

This changelog reports changes to the rules and rule groups in AWS Managed Rules for AWS WAF.

For the IP reputation rule groups, this changelog reports changes to the rules and rule group, but it doesn't report changes to the IP address lists that are used by the rules, due to the dynamic nature of those lists.

Rule group and rules Description Date
PHP application managed rule group

  • Updated PHPHighRiskMethodsVariables_BODY

  • Removed PHPHighRiskMethodsVariables_QUERYARGUMENTS

  • Added PHPHighRiskMethodsVariables_QUERYSTRING

  • Added PHPHighRiskMethodsVariables_HEADER

Released static version 2.0 of this rule group.

Added signatures to improve detection in all rules.

Replaced the rule PHPHighRiskMethodsVariables_QUERYARGUMENTS with PHPHighRiskMethodsVariables_QUERYSTRING, which inspects the entire query string instead of just the query arguments.

Added the rule PHPHighRiskMethodsVariables_HEADER, to expand coverage to include all headers.

Updated the following labels to align with standard AWS Managed Rules labeling:

  • Old name: PHPHighRiskMethodsVariables_BODY New name: PHPHighRiskMethodsVariables_Body

  • Old name: PHPHighRiskMethodsVariables_QUERYARGUMENTS New name: PHPHighRiskMethodsVariables_QueryString

 2023-02-27
AWS WAF Fraud Control account takeover prevention (ATP) rule group

  • VolumetricIpFailedLoginResponseHigh

  • VolumetricSessionFailedLoginResponseHigh

Added login response inspection rules for use with protected Amazon CloudFront distributions. These rules can block new login attempts from IP addresses and client sessions that have recently been the source of too many failed login attempts.

2023-02-15
Core rule set (CRS) managed rule group

  • NoUserAgent_HEADER

  • CrossSiteScripting_COOKIE

  • CrossSiteScripting_QUERYARGUMENTS

  • CrossSiteScripting_BODY

  • CrossSiteScripting_URIPATH

Released static version 1.5 of this rule group.

Updated Cross Site Scripting (XSS) filters to improve detection.

2023-01-25
Linux operating system managed rule group

  • LFI_COOKIE - removed

  • LFI_HEADER - added

  • LFI_URIPATH

  • LFI_QUERYSTRING

  • LFI_BODY

Released static version 2.1 of this rule group.

Removed the rule LFI_COOKIE and its label awswaf:managed:aws:linux-os:LFI_Cookie, and replaced them with the new rule LFI_HEADER and its label awswaf:managed:aws:linux-os:LFI_Header. This change expands inspection to multiple headers.

Added text transformations and signatures to all rules to improve detection.

 2022-12-15
Core rule set (CRS) managed rule group

  • NoUserAgent_HEADER

  • CrossSiteScripting_COOKIE

  • CrossSiteScripting_QUERYARGUMENTS

  • CrossSiteScripting_BODY

  • CrossSiteScripting_URIPATH

Released static version 1.4 of this rule group.

Added a text transformation to NoUserAgent_HEADER to remove all null bytes. Updated the filters in the cross-site scripting rules to improve detection.

2022-12-05
Known bad inputs managed rule group

  • JavaDeserializationRCE_BODY

  • JavaDeserializationRCE_URIPATH

  • JavaDeserializationRCE_HEADER

  • JavaDeserializationRCE_QUERYSTRING

  • Host_localhost_HEADER

Released static version 1.17 of this rule group.

Updated the Java deserialization rules to add detection for requests matching Apache CVE-2022-42889, a remote code execution (RCE) vulnerability in Apache Commons Text versions prior to 1.10.0. For more information, see NIST: National Vulnerability Database: CVE-2022-42889 Detail and CVE-2022-42889: Apache Commons Text prior to 1.10.0 allows RCE when applied to untrusted input due to insecure interpolation defaults.

Improved detection in Host_localhost_HEADER.

 2022-10-20
Known bad inputs managed rule group

  • Log4JRCE_HEADER

  • Log4JRCE_QUERYSTRING

  • Log4JRCE_URIPATH

  • Log4JRCE_BODY

Released static version 1.16 of this rule group.

Removed false positives that AWS identified in version 1.15.

 2022-10-05

POSIX operating system managed rule group

PHP application managed rule group

WordPress application managed rule group

Corrected the documented label names.

2022-09-19
IP reputation rule groups

  • AWSManagedIPDDoSList

This change doesn't alter how the rule group handles your web traffic.

Added a new rule with Count action to inspect for IP addresses that are actively engaging in DDoS activities, according to Amazon threat intelligence.

 2022-08-30
Known bad inputs managed rule group

  • Log4JRCE

  • Log4JRCE_HEADER

  • Log4JRCE_QUERYSTRING

  • Log4JRCE_URIPATH

  • Log4JRCE_BODY

  • JavaDeserializationRCE_HEADER

  • JavaDeserializationRCE_BODY

  • JavaDeserializationRCE_URIPATH

  • JavaDeserializationRCE_QUERYSTRING

  • Host_localhost_HEADER

  • PROPFIND_METHOD

Released static version 1.15 of this rule group.

Removed Log4JRCE and replaced it with Log4JRCE_HEADER, Log4JRCE_QUERYSTRING, Log4JRCE_URI, and Log4JRCE_BODY, for more granular monitoring and management of false positives.

Added signatures for improved detection and blocking to PROPFIND_METHOD and to all JavaDeserializationRCE* and Log4JRCE* rules.

Updated labels to correct capitalization in Host_localhost_HEADER and in all JavaDeserializationRCE* rules.

Corrected the description of JavaDeserializationRCE_HEADER.

 2022-08-22
AWS WAF Fraud Control account takeover prevention (ATP) rule group

  • UnsupportedCognitoIDP

Added a rule to prevent the use of the account takeover prevention managed rule group for Amazon Cognito user pool web traffic.

2022-08-11
Core rule set (CRS) managed rule group

AWS has scheduled expiration for versions Version_1.2 and Version_2.0 of the rule group. The versions will expire on September 9, 2022. For information about version expiration, see Version management with managed rule groups.

 2022-06-09
Core rule set (CRS) managed rule group

  • GenericLFI_URIPATH

    GenericRFI_URIPATH

Released version 1.3 of this rule group. This release updates the match signatures in the rules GenericLFI_URIPATH and GenericRFI_URIPATH, to improve detection.

2022-05-24
AWS WAF Bot Control rule group

  • CategoryEmailClient

Added the rule CategoryEmailClient to the rule group.

2022-04-06
Known bad inputs managed rule group

  • JavaDeserializationRCE_HEADER

  • JavaDeserializationRCE_BODY

  • JavaDeserializationRCE_URI

  • JavaDeserializationRCE_QUERYSTRING

Released version 1.14 of this rule group. The four JavaDeserializtionRCE rules are moved to BLOCK mode.

 2022-03-31
Known bad inputs managed rule group

  • JavaDeserializationRCE_HEADER_RC_COUNT

  • JavaDeserializationRCE_BODY_RC_COUNT

  • JavaDeserializationRCE_URI_RC_COUNT

  • JavaDeserializationRCE_QUERYSTRING_RC_COUNT

Released version 1.13 of this rule group. Updated the text transformation for Spring Core and Cloud Function RCE vulnerabilities. These rules are in count mode to gather metrics and evaluate matched patterns. The label can be used to block requests in a custom rule. A subsequent version will be deployed with these rules in block mode.

 2022-03-31
Known bad inputs managed rule group

  • JavaDeserializationRCE_HEADER_RC_COUNT

  • JavaDeserializationRCE_BODY_RC_COUNT

  • JavaDeserializationRCE_URI_RC_COUNT

  • JavaDeserializationRCE_QUERYSTRING_RC_COUNT

  • Log4JRCE_HEADER

  • Log4JRCE_QUERYSTRING

  • Log4JRCE_URI

  • Log4JRCE_BODY

  • Log4JRCE

Released version 1.12 of this rule group. Added signatures for Spring Core and Cloud Function RCE vulnerabilities. These rules are in count mode to gather metrics and evaluate matched patterns. The label can be used to block requests in a custom rule. A subsequent version will be deployed with these rules in block mode.

Removed the rules Log4JRCE_HEADER, Log4JRCE_QUERYSTRING, Log4JRCE_URI, and Log4JRCE_BODY and replaced them with the rule Log4JRCE.

 2022-03-30
IP reputation rule groups

  • AWSManagedReconnaissanceList

 Updated the AWSManagedReconnaissanceList rule to change the action from count to block. 2022-02-15
AWS WAF Fraud Control account takeover prevention (ATP) rule group

All rules in new rule group

 Added the rule group AWSManagedRulesATPRuleSet. 2022-02-11
Known bad inputs managed rule group

  • Log4JRCE

  • Log4JRCE_HEADER

  • Log4JRCE_QUERYSTRING

  • Log4JRCE_URI

  • Log4JRCE_BODY

Released version 1.9 of this rule group. Removed the rule Log4JRCE and replaced it with the rules Log4JRCE_HEADER, Log4JRCE_QUERYSTRING, Log4JRCE_URI, and Log4JRCE_BODY, for flexibility in the use of this functionality. Added signatures to improve detection and blocking.

 2022-01-28
Core rule set (CRS)

  • CrossSiteScripting_URIPATH

  • CrossSiteScripting_BODY

  • CrossSiteScripting_QUERYARGUMENTS

  • CrossSiteScripting_COOKIE

Released version 2.0 of this rule group. For these rules, tuned detection signatures to reduce false positives. Replaced the URL_DECODE text transformation with the double URL_DECODE_UNI text transformation. Added the HTML_ENTITY_DECODE text transformation.

 2022-01-10
Core rule set (CRS)

  • RestrictedExtensions_URIPATH

  • RestrictedExtensions_QUERYARGUMENTS

As part of the release of version 2.0 of this rule group, added the URL_DECODE_UNI text transformation. Removed the URL_DECODE text transformation from RestrictedExtensions_URIPATH.

 2022-01-10
SQL database

  • SQLi_BODY

  • SQLi_QUERYARGUMENTS

  • SQLi_COOKIE

  • SQLi_URIPATH

  • SQLiExtendedPatterns_BODY

  • SQLiExtendedPatterns_QUERYARGUMENTS

Released version 2.0 of this rule group. Replaced the URL_DECODE text transformation with the double URL_DECODE_UNI text transformation and added the COMPRESS_WHITE_SPACE text transformation.

Added more detection signatures to SQLiExtendedPatterns_QUERYARGUMENTS.

Added JSON inspection to SQLi_BODY.

Added the rule SQLiExtendedPatterns_BODY.

Removed the rule SQLi_URIPATH.

 2022-01-10
Known bad inputs

  • Log4JRCE

Released version 1.8 of the rule Log4JRCE to improve header inspection and matching criteria.

 2021-12-17
Known bad inputs

  • Log4JRCE

Released version 1.4 of the rule Log4JRCE to tune the matching criteria and to inspect additional headers. Released version 1.5 to tune the matching criteria.

 2021-12-11
Known bad inputs

  • Log4JRCE

  • BadAuthToken_COOKIE_AUTHORIZATION

Added the rule Log4JRCE version 1.2 in response to the recently disclosed security issue within Log4j. For information see CVE-2021-44228. This rule inspects common URI paths, query strings, the first 8KB of the request body, and common headers. The rule uses double URL_DECODE_UNI text transformations. Released version 1.3 of Log4JRCE to tune the matching criteria and to inspect additional headers.

Removed the rule BadAuthToken_COOKIE_AUTHORIZATION.

 2021-12-10

The following table lists changes prior to December, 2021.

Rule group and rules Description Date
Amazon IP reputation list

AWSManagedReconnaissanceList

 Added the AWSManagedReconnaissanceList rule in monitoring/count mode. This rule contains IP addresses that are performing reconnaissance against AWS resources. 2021-11-23
Windows operating system

WindowsShellCommands

PowerShellCommands

Added three new rules for WindowsShell commands: WindowsShellCommands_COOKIE, WindowsShellCommands_QUERYARGUMENTS, and WindowsShellCommands_BODY.

Added a new PowerShell rule: PowerShellCommands_COOKIE.

Restructured the PowerShellComands rules naming by removing the string _Set1 and _Set2.

Added more comprehensive detection signatures to PowerShellRules.

Added URL_DECODE_UNI text transformation to all Windows operating system rules.

 2021-11-23
Linux operating system

LFI_URIPATH

LFI_QUERYSTRING

LFI_BODY

LFI_COOKIE

Replaced double URL_DECODE text transformation with double URL_DECODE_UNI.

Added NORMALIZE_PATH_WIN as a second text transformation.

Replaced the LFI_BODY rule with the LFI_COOKIE rule.

Added more comprehensive detection signatures for all LFI rules.

 2021-11-23
Core rule set (CRS)

SizeRestrictions_BODY

 Reduced the size limit to block web requests with body payloads larger than 8 KB. Previously, the limit was 10 KB. 2021-10-27
Core rule set (CRS)

EC2MetaDataSSRF_BODY

EC2MetaDataSSRF_COOKIE

EC2MetaDataSSRF_URIPATH

EC2MetaDataSSRF_QUERYARGUMENTS

 Added more detection signatures. Added double unicode URL decode to improve blocking. 2021-10-27
Core rule set (CRS)

GenericLFI_QUERYARGUMENTS

GenericLFI_URIPATH

RestrictedExtensions_URIPATH

RestrictedExtensions_QUERYARGUMENTS

 Added double unicode URL decode to improve blocking. 2021-10-27
Core rule set (CRS)

GenericRFI_QUERYARGUMENTS

GenericRFI_BODY

GenericRFI_URIPATH

 Updated the rule signatures to reduce false positives, based on customer feedback. Added double unicode URL decode to improve blocking. 2021-10-27
All

All rules

 Added support for AWS WAF labels to all rules that didn't already support labeling. 2021-10-25
Amazon IP reputation list

AWSManagedIPReputationList_xxxx

 Restructured the IP reputation list, removed suffixes from rule name, and added support for AWS WAF labels. 2021-05-04
Anonymous IP list

AnonymousIPList

HostingProviderList

 Added support for AWS WAF labels. 2021-05-04
Bot Control All Added the Bot Control rule set. 2021-04-01
Core rule set (CRS)

GenericRFI_QUERYARGUMENTS

 Added double URL decode. 2021-03-03
Core rule set (CRS)

RestrictedExtensions_URIPATH

 Improved the configuration of the rules and added an extra URL decode. 2021-03-03
Admin protection

AdminProtection_URIPATH

 Added double URL decode. 2021-03-03
Known bad inputs

ExploitablePaths_URIPATH

 Improved the configuration of the rules and added an extra URL decode. 2021-03-03
Linux operating system

LFI_QUERYARGUMENTS

 Improved the configuration of the rules and added an extra URL decode. 2021-03-03
Windows operating system All Improved the configuration of the rules. 2020-09-23
PHP application

PHPHighRiskMethodsVariables_QUERYARGUMENTS

PHPHighRiskMethodsVariables_BODY

 Changed the text transformation from HTML decode to URL decode, to improve blocking. 2020-09-16
POSIX operating system

UNIXShellCommandsVariables_QUERYARGUMENTS

UNIXShellCommandsVariables_BODY

 Changed the text transformation from HTML decode to URL decode, to improve blocking. 2020-09-16
Core rule set

GenericLFI_QUERYARGUMENTS

GenericLFI_URIPATH

GenericLFI_BODY

 Changed the text transformation from HTML decode to URL decode, to improve blocking. 2020-08-07
Linux operating system

LFI_URIPATH

LFI_QUERYARGUMENTS

LFI_BODY

 Changed the text transformation from HTML entity decode to URL decode, to improve detection and blocking. 2020-05-19
Anonymous IP List All New rule group in IP reputation rule groups to block requests from services that permit the obfuscation of viewer identity, to help mitigate bots and evasion of geographic restrictions. 2020-03-06
WordPress application

WordPressExploitableCommands_QUERYSTRING

 New rule that checks for exploitable commands in the query string. 2020-03-03
Core rule set (CRS)

SizeRestrictions_QUERYSTRING

SizeRestrictions_Cookie_HEADER

SizeRestrictions_BODY

SizeRestrictions_URIPATH

 Adjusted the size value constraints for improved accuracy. 2020-03-03
SQL database

SQLi_URIPATH

 The rules now check the message URI. 2020-01-23
SQL database

SQLi_BODY

SQLi_QUERYARGUMENTS

SQLi_COOKIE

 Updated text transformations. 2019-12-20
Core rule set (CRS)

CrossSiteScripting_URIPATH

CrossSiteScripting_BODY

CrossSiteScripting_QUERYARGUMENTS

CrossSiteScripting_COOKIE

 Updated text transformations. 2019-12-20