{"id":1592,"date":"2013-01-03T23:59:41","date_gmt":"2013-01-03T21:59:41","guid":{"rendered":"http:\/\/www.void.gr\/kargig\/blog\/?p=1592"},"modified":"2013-01-04T00:09:22","modified_gmt":"2013-01-03T22:09:22","slug":"mitigating-wordpress-xmlrpc-attack-using-ossec","status":"publish","type":"post","link":"https:\/\/www.void.gr\/kargig\/blog\/2013\/01\/03\/mitigating-wordpress-xmlrpc-attack-using-ossec\/","title":{"rendered":"mitigating wordpress xmlrpc attack using ossec"},"content":{"rendered":"

I’ve created some local rules for ossec<\/a> to mitigate some of the effects of the wordpress xmlrpc attack presented here: WordPress Pingback Portscanner \u2013 Metasploit Module<\/a>.<\/p>\n

They seem to work for me, use at your own risk of getting flooded with tons of alerts. Obviously you need to set the alert level of the second rule to something that will trigger your active-response. Feel free to tweak the alert level, frequency and timeframe. Before you change frequency to something else please read the following thread though: setting ossec frequency level<\/a><\/p>\n

\n   <rule id="100167" level="1">\n    <if_sid>31108<\/if_sid>\n    <url>xmlrpc.php<\/url>\n    <match>POST<\/match>\n    <description>WordPress xmlrpc attempt.<\/description>\n  <\/rule>\n\n  <rule id="100168" level="10" frequency="2" timeframe="600">\n    <if_matched_sid>100167<\/if_matched_sid>\n    <same_source_ip \/>\n    <description>WordPress xmlrpc attack.<\/description>\n    <group>attack,<\/group>\n   <\/rule>\n<\/code2><\/pre><\/p>\n
btw, if you don’t want xmlrpc.php accessible at all, you can block it through a simple mod_rewrite rule:
\n
\n<IfModule mod_rewrite.c>\nRewriteEngine On\nRewriteCond %{REQUEST_URI} ^\/PATH\/TO\/xmlrpc.php [NC]\nRewriteRule ^(.*)$ - [F,L]\n<\/code2><\/pre><\/p>\n
or you can try any of the other numerous ways to accomplish the same thing as presented here<\/a>.<\/p>\n
You’ll lose pingback functionality though…oh well.<\/p>\n","protected":false},"excerpt":{"rendered":"
I’ve created some local rules for ossec to mitigate some of the effects of the wordpress xmlrpc attack presented here: WordPress Pingback Portscanner \u2013 Metasploit Module. They seem to work for me, use at your own risk of getting flooded with tons of alerts. Obviously you need to set the alert level of the second […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"ep_exclude_from_search":false,"footnotes":""},"categories":[5,3,8],"tags":[457,597,595,217,540,185,16,541],"class_list":["post-1592","post","type-post","status-publish","format-standard","hentry","category-internet","category-linux","category-networking","tag-attack","tag-internet","tag-linux","tag-ossec","tag-portscan","tag-vulnerability","tag-wordpress","tag-xmlrpc"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t