ꦫꦣꦺꦤ꧀ꦄꦤ꧀ꦠꦱꦺꦤ

PATH: opt / bitninja-waf3 / coreruleset / rules

# Sources:
# Microsoft PowerShell Docs: https://github.com/MicrosoftDocs/PowerShell-Docs
# - curl -H "Accept: application/vnd.github.v3+json" https://api.github.com/repos/MicrosoftDocs/PowerShell-Docs/git/trees/main\?recursive\=1 | jq -r '.tree[] .path | capture("reference/\\d.\\d/(.*)/(?<fn>[A-Z]\\w+-\\w+).md") | .fn' | sort | uniq

powershell
Add-Computer
Add-Content
Add-History
Add-JobTrigger
Add-LocalGroupMember
Add-Member
Add-PSSnapin
Add-Type
Checkpoint-Computer
Clear-Content
Clear-EventLog
Clear-History
Clear-Host
Clear-Item
Clear-ItemProperty
Clear-RecycleBin
Clear-Variable
Compare-Object
Complete-Transaction
Compress-Archive
Connect-PSSession
Connect-WSMan
Convert-Path
Convert-String
ConvertFrom-Csv
ConvertFrom-Json
ConvertFrom-Markdown
ConvertFrom-SddlString
ConvertFrom-SecureString
ConvertFrom-String
ConvertFrom-StringData
ConvertTo-Csv
ConvertTo-Html
ConvertTo-Json
ConvertTo-SecureString
ConvertTo-Xml
Copy-Item
Copy-ItemProperty
Debug-Job
Debug-Process
Debug-Runspace
Disable-ComputerRestore
Disable-ExperimentalFeature
Disable-JobTrigger
Disable-LocalUser
Disable-PSBreakpoint
Disable-PSRemoting
Disable-PSSessionConfiguration
Disable-PSTrace
Disable-PSWSManCombinedTrace
Disable-RunspaceDebug
Disable-ScheduledJob
Disable-WSManCredSSP
Disable-WSManTrace
Disconnect-PSSession
Disconnect-WSMan
Enable-ComputerRestore
Enable-ExperimentalFeature
Enable-JobTrigger
Enable-LocalUser
Enable-PSBreakpoint
Enable-PSRemoting
Enable-PSSessionConfiguration
Enable-PSTrace
Enable-PSWSManCombinedTrace
Enable-RunspaceDebug
Enable-ScheduledJob
Enable-WSManCredSSP
Enable-WSManTrace
Enter-PSHostProcess
Enter-PSSession
Exit-PSHostProcess
Exit-PSSession
Expand-Archive
Export-Alias
Export-BinaryMiLog
Export-Clixml
Export-Console
Export-Counter
Export-Csv
Export-FormatData
Export-ModuleMember
Export-ODataEndpointProxy
Export-PSSession
Find-Command
Find-DscResource
Find-Module
Find-Package
Find-PackageProvider
Find-RoleCapability
Find-Script
ForEach-Object
Format-Custom
Format-Hex
Format-List
Format-Table
Format-Wide
Get-Acl
Get-Alias
Get-AuthenticodeSignature
Get-ChildItem
Get-CimAssociatedInstance
Get-CimClass
Get-CimInstance
Get-CimSession
Get-Clipboard
Get-CmsMessage
Get-Command
Get-ComputerInfo
Get-ComputerRestorePoint
Get-Content
Get-ControlPanelItem
Get-Counter
Get-Credential
Get-Culture
Get-Date
Get-Error
Get-Event
Get-EventLog
Get-EventSubscriber
Get-ExecutionPolicy
Get-ExperimentalFeature
Get-FileHash
Get-FormatData
Get-Help
Get-History
Get-Host
Get-HotFix
Get-InstalledModule
Get-InstalledScript
Get-IseSnippet
Get-Item
Get-ItemProperty
Get-ItemPropertyValue
Get-Job
Get-JobTrigger
Get-LocalGroup
Get-LocalGroupMember
Get-LocalUser
Get-Location
Get-LogProperties
Get-MarkdownOption
Get-Member
Get-Module
Get-OperationValidation
Get-PSBreakpoint
Get-PSCallStack
Get-PSDrive
Get-PSHostProcessInfo
Get-PSProvider
Get-PSReadLineKeyHandler
Get-PSReadLineOption
Get-PSRepository
Get-PSSession
Get-PSSessionCapability
Get-PSSessionConfiguration
Get-PSSnapin
Get-PSSubsystem
Get-Package
Get-PackageProvider
Get-PackageSource
Get-PfxCertificate
Get-Process
Get-Random
Get-Runspace
Get-RunspaceDebug
Get-ScheduledJob
Get-ScheduledJobOption
Get-Service
Get-TimeZone
Get-TraceSource
Get-Transaction
Get-TypeData
Get-UICulture
Get-Unique
Get-Uptime
Get-Variable
Get-Verb
Get-WSManCredSSP
Get-WSManInstance
Get-WinEvent
Get-WmiObject
Group-Object
Import-Alias
Import-BinaryMiLog
Import-Clixml
Import-Counter
Import-Csv
Import-IseSnippet
Import-LocalizedData
Import-Module
Import-PSSession
Import-PackageProvider
Import-PowerShellDataFile
Install-Module
Install-Package
Install-PackageProvider
Install-Script
Invoke-AsWorkflow
Invoke-CimMethod
Invoke-Command
Invoke-Expression
Invoke-History
Invoke-Item
Invoke-OperationValidation
Invoke-RestMethod
Invoke-WSManAction
Invoke-WebRequest
Invoke-WmiMethod
Join-Path
Join-String
Limit-EventLog
Measure-Command
Measure-Object
Move-Item
Move-ItemProperty
New-Alias
New-CimInstance
New-CimSession
New-CimSessionOption
New-Event
New-EventLog
New-FileCatalog
New-Guid
New-IseSnippet
New-Item
New-ItemProperty
New-JobTrigger
New-LocalGroup
New-LocalUser
New-Module
New-ModuleManifest
New-Object
New-PSDrive
New-PSRoleCapabilityFile
New-PSSession
New-PSSessionConfigurationFile
New-PSSessionOption
New-PSTransportOption
New-PSWorkflowExecutionOption
New-PSWorkflowSession
New-ScheduledJobOption
New-ScriptFileInfo
New-Service
New-TemporaryFile
New-TimeSpan
New-Variable
New-WSManInstance
New-WSManSessionOption
New-WebServiceProxy
New-WinEvent
Out-Default
Out-File
Out-GridView
Out-Host
Out-Null
Out-Printer
Out-String
Pop-Location
Protect-CmsMessage
Publish-Module
Publish-Script
Push-Location
Read-Host
Receive-Job
Receive-PSSession
Register-ArgumentCompleter
Register-CimIndicationEvent
Register-EngineEvent
Register-ObjectEvent
Register-PSRepository
Register-PSSessionConfiguration
Register-PackageSource
Register-ScheduledJob
Register-WmiEvent
Remove-Alias
Remove-CimInstance
Remove-CimSession
Remove-Computer
Remove-Event
Remove-EventLog
Remove-Item
Remove-ItemProperty
Remove-Job
Remove-JobTrigger
Remove-LocalGroup
Remove-LocalGroupMember
Remove-LocalUser
Remove-Module
Remove-PSBreakpoint
Remove-PSDrive
Remove-PSReadLineKeyHandler
Remove-PSSession
Remove-PSSnapin
Remove-Service
Remove-TypeData
Remove-Variable
Remove-WSManInstance
Remove-WmiObject
Rename-Computer
Rename-Item
Rename-ItemProperty
Rename-LocalGroup
Rename-LocalUser
Reset-ComputerMachinePassword
Resolve-Path
Restart-Computer
Restart-Service
Restore-Computer
Resume-Job
Resume-Service
Save-Help
Save-Module
Save-Package
Save-Script
Select-Object
Select-String
Select-Xml
Send-MailMessage
Set-Acl
Set-Alias
Set-AuthenticodeSignature
Set-CimInstance
Set-Clipboard
Set-Content
Set-Date
Set-ExecutionPolicy
Set-Item
Set-ItemProperty
Set-JobTrigger
Set-LocalGroup
Set-LocalUser
Set-Location
Set-LogProperties
Set-MarkdownOption
Set-PSBreakpoint
Set-PSDebug
Set-PSReadLineKeyHandler
Set-PSReadLineOption
Set-PSRepository
Set-PSSessionConfiguration
Set-PackageSource
Set-ScheduledJob
Set-ScheduledJobOption
Set-Service
Set-StrictMode
Set-TimeZone
Set-TraceSource
Set-Variable
Set-WSManInstance
Set-WSManQuickConfig
Set-WmiInstance
Show-Command
Show-ControlPanelItem
Show-EventLog
Show-Markdown
Sort-Object
Split-Path
Start-Job
Start-Process
Start-Service
Start-Sleep
Start-ThreadJob
Start-Trace
Start-Transaction
Start-Transcript
Stop-Computer
Stop-Job
Stop-Process
Stop-Service
Stop-Trace
Stop-Transcript
Suspend-Job
Suspend-Service
Switch-Process
Tee-Object
Test-ComputerSecureChannel
Test-Connection
Test-FileCatalog
Test-Json
Test-ModuleManifest
Test-PSSessionConfigurationFile
Test-Path
Test-ScriptFileInfo
Test-WSMan
Trace-Command
Unblock-File
Undo-Transaction
Uninstall-Module
Uninstall-Package
Uninstall-Script
Unprotect-CmsMessage
Unregister-Event
Unregister-PSRepository
Unregister-PSSessionConfiguration
Unregister-PackageSource
Unregister-ScheduledJob
Update-FormatData
Update-Help
Update-List
Update-Module
Update-ModuleManifest
Update-Script
Update-ScriptFileInfo
Update-TypeData
Use-Transaction
Wait-Debugger
Wait-Event
Wait-Job
Wait-Process
Where-Object
Write-Debug
Write-Error
Write-EventLog
Write-Host
Write-Information
Write-Output
Write-Progress
Write-Verbose
Write-Warning

[-] REQUEST-932-APPLICATION-ATTACK-RCE.conf [edit]
[-] REQUEST-943-APPLICATION-ATTACK-SESSION-FIXATION.conf [edit]
[-] ssrf.data [edit]
[-] REQUEST-931-APPLICATION-ATTACK-RFI.conf [edit]
[+] ..
[-] REQUEST-941-APPLICATION-ATTACK-XSS.conf [edit]
[-] REQUEST-920-PROTOCOL-ENFORCEMENT.conf [edit]
[-] REQUEST-949-BLOCKING-EVALUATION.conf [edit]
[-] RESPONSE-999-EXCLUSION-RULES-AFTER-CRS.conf.example [edit]
[-] REQUEST-922-MULTIPART-ATTACK.conf [edit]
[-] web-shells-php.data [edit]
[-] REQUEST-933-APPLICATION-ATTACK-PHP.conf [edit]
[-] RESPONSE-953-DATA-LEAKAGES-PHP.conf [edit]
[-] RESPONSE-950-DATA-LEAKAGES.conf [edit]
[-] REQUEST-900-EXCLUSION-RULES-BEFORE-CRS.conf.example [edit]
[-] sql-errors.data [edit]
[-] restricted-files.data [edit]
[-] restricted-upload.data [edit]
[-] REQUEST-921-PROTOCOL-ATTACK.conf [edit]
[-] REQUEST-913-SCANNER-DETECTION.conf [edit]
[-] php-config-directives.data [edit]
[-] RESPONSE-951-DATA-LEAKAGES-SQL.conf [edit]
[-] php-variables.data [edit]
[-] RESPONSE-954-DATA-LEAKAGES-IIS.conf [edit]
[-] unix-shell.data [edit]
[-] REQUEST-901-INITIALIZATION.conf [edit]
[-] php-function-names-933151.data [edit]
[-] iis-errors.data [edit]
[-] REQUEST-911-METHOD-ENFORCEMENT.conf [edit]
[-] RESPONSE-952-DATA-LEAKAGES-JAVA.conf [edit]
[-] scanners-user-agents.data [edit]
[-] RESPONSE-980-CORRELATION.conf [edit]
[-] php-function-names-933150.data [edit]
[-] REQUEST-944-APPLICATION-ATTACK-JAVA.conf [edit]
[-] java-errors.data [edit]
[-] windows-powershell-commands.data [edit]
[-] REQUEST-942-APPLICATION-ATTACK-SQLI.conf [edit]
[-] java-classes.data [edit]
[-] php-errors-pl2.data [edit]
[-] php-errors.data [edit]
[-] REQUEST-905-COMMON-EXCEPTIONS.conf [edit]
[-] RESPONSE-959-BLOCKING-EVALUATION.conf [edit]
[-] REQUEST-930-APPLICATION-ATTACK-LFI.conf [edit]
[-] RESPONSE-955-WEB-SHELLS.conf [edit]
[-] java-code-leakages.data [edit]
[-] REQUEST-934-APPLICATION-ATTACK-GENERIC.conf [edit]
[-] lfi-os-files.data [edit]