Operators :: WGE

@rx

Mon, 01 Jan 0001 00:00:00 +0000

Description: Regular expression matching using RE2 Syntax: @rx pattern Input Data Type: string @rx is the most commonly used operator in SecLang. By default, WGE uses RE2 for regex matching. If RE2 compilation fails, WGE attempts to use PCRE2 as fallback. If no operator keyword is explicitly provided in a rule, regex matching is used by default. Example: # Detect SQL injection keywords SecRule ARGS "@rx (?i:select|union|insert|update|delete|drop)" \ "id:1001,phase:2,deny,msg:'SQL Injection detected'" # Detect XSS attack pattern SecRule ARGS "@rx ]*>.*?" \ "id:1002,phase:2,deny,msg:'XSS Attack detected'" # Use regex when operator keyword is omitted SecRule ARGS "admin" "id:1003,phase:2,deny,msg:'test'"

@contains

Mon, 01 Jan 0001 00:00:00 +0000

Description: Contains the specified string Syntax: "@contains string" @contains checks if the variable value contains the specified substring. Matching is case sensitive. Compared to @rx, @contains performs better for simple substring searches as it avoids regex engine overhead. Example: # Detect if Content-Type contains multipart SecRule REQUEST_HEADERS:Content-Type "@contains multipart" \ "id:1068,phase:1,pass,nolog,ctl:requestBodyProcessor=MULTIPART" # Detect if URL contains admin SecRule REQUEST_URI "@contains admin" \ "id:1069,phase:1,log,msg:'Accessing admin path'" Parameter Type: string

@beginsWith

Mon, 01 Jan 0001 00:00:00 +0000

Description: Begins with the specified string Syntax: "@beginsWith string" @beginsWith checks if the variable value begins with the specified string. Matching is case sensitive. Compared to using @rx “^prefix” regex, @beginsWith performs better for simple prefix checks as it avoids regex engine overhead. Commonly used for URL path checks, protocol validation, and similar scenarios. Example: # Detect admin panel access SecRule REQUEST_URI "@beginsWith /admin" \ "id:1070,phase:1,deny,msg:'Unauthorized access to admin path'" # Detect API path and tag SecRule REQUEST_URI "@beginsWith /api/v" \ "id:1071,phase:1,pass,nolog,setvar:tx.is_api_request=1" # Detect dangerous protocols (e.g., javascript:) SecRule ARGS "@beginsWith javascript:" \ "id:1072,phase:2,deny,msg:'JavaScript protocol injection detected'" # Detect Base64 encoded data SecRule REQUEST_BODY "@beginsWith data:image" \ "id:1073,phase:2,pass,nolog,setvar:tx.has_base64_image=1" Parameter Type: string

@endsWith

Mon, 01 Jan 0001 00:00:00 +0000

Description: Ends with the specified string Syntax: "@endsWith string" @endsWith checks if the variable value ends with the specified string. Matching is case sensitive. Compared to using @rx “suffix$” regex, @endsWith performs better for simple suffix checks. Commonly used for file extension checks, path validation, and similar scenarios. Example: # Detect dangerous file extension access SecRule REQUEST_FILENAME "@endsWith .bak" \ "id:1074,phase:1,deny,msg:'Access to backup files forbidden'" # Detect config file access SecRule REQUEST_URI "@endsWith .conf" \ "id:1075,phase:1,deny,msg:'Access to config files forbidden'" # Detect PHP file upload SecRule FILES_NAMES "@endsWith .php" \ "id:1076,phase:2,deny,msg:'PHP file upload forbidden'" # Detect hidden files (Unix-style) SecRule REQUEST_FILENAME "@endsWith /.htaccess" \ "id:1077,phase:1,deny,msg:'Access to .htaccess file forbidden'" Parameter Type: string

@within

Mon, 01 Jan 0001 00:00:00 +0000

Description: Value is within the specified string Syntax: "@within string" @within is the reverse of @contains: checks if the variable value exists as a substring within the specified parameter string. In other words, it checks if the parameter string contains the variable value. Matching is case sensitive. This is particularly useful for whitelist checks to verify if a value is in the allowed list. Example: # Validate HTTP method is in allowed list SecRule REQUEST_METHOD "!@within GET POST HEAD OPTIONS" \ "id:1078,phase:1,deny,msg:'Disallowed HTTP method'" # Validate file extension is in whitelist SecRule FILES_COMBINED_SIZE "@gt 0" \ "id:1079,phase:2,chain" SecRule FILES_NAMES "!@within .jpg .png .gif .pdf" \ "deny,msg:'Disallowed file type'" # Validate Content-Type is legitimate SecRule REQUEST_HEADERS:Content-Type "!@within application/json application/xml text/plain" \ "id:1080,phase:1,deny,msg:'Unsupported Content-Type'" Parameter Type: string

@containsWord

Mon, 01 Jan 0001 00:00:00 +0000

Description: Contains the specified word Syntax: "@containsWord parameter" Example: SecRule ARGS "@containsWord parameter" "id:1001,deny,msg:'Test'" Parameter Type: string Implementation Status: Not yet implemented

@streq

Mon, 01 Jan 0001 00:00:00 +0000

Description: String equality Syntax: "@streq string" @streq checks if the variable value exactly equals the specified string. Matching is case sensitive. Compared to @rx “^exact$” regex, @streq performs better for exact string comparisons. For case-insensitive comparison, apply the lowercase transformation function first. Commonly used for exact value validation, flag checks, and similar scenarios. Example: # Exact match HTTP method SecRule REQUEST_METHOD "@streq POST" \ "id:1081,phase:1,pass,nolog,setvar:tx.is_post=1" # Validate specific header value SecRule REQUEST_HEADERS:X-Requested-With "@streq XMLHttpRequest" \ "id:1082,phase:1,pass,nolog,setvar:tx.is_ajax=1" # Case-insensitive comparison (using lowercase transform) SecRule REQUEST_HEADERS:Accept "!@streq application/json" \ "id:1083,phase:1,t:lowercase,deny,msg:'Only JSON requests accepted'" # Detect specific user agent SecRule REQUEST_HEADERS:User-Agent "@streq curl/7.68.0" \ "id:1084,phase:1,log,pass,msg:'curl client detected'" Parameter Type: string

@strmatch

Mon, 01 Jan 0001 00:00:00 +0000

Description: Wildcard matching Syntax: "@strmatch parameter" Example: SecRule ARGS "@strmatch parameter" "id:1001,deny,msg:'Test'" Parameter Type: string (wildcard) Implementation Status: Not yet implemented

@pm

Mon, 01 Jan 0001 00:00:00 +0000

Description: Performs efficient multi-pattern parallel matching using the Aho-Corasick algorithm Syntax: "@pm keyword1 keyword2 keyword3 ..." @pm operator can search for multiple keywords simultaneously, separated by spaces. Compared to multiple @rx rules, @pm performs better when matching a large number of keywords. Matching is case insensitive. Example: # Detect common SQL injection keywords SecRule ARGS "@pm select union insert update delete" \ "id:1001,phase:2,deny,msg:'SQL keyword detected'" # Detect sensitive file access SecRule REQUEST_URI "@pm /etc/passwd /etc/shadow .htaccess" \ "id:1002,phase:1,deny,msg:'Sensitive file access'" Parameter Type: string (space-separated keyword list)

@pmf

Mon, 01 Jan 0001 00:00:00 +0000

Description: Loads keywords from file for parallel matching (alias for @pmFromFile) Syntax: "@pmf /path/to/keywords.txt" Same as @pm, but loads keyword list from external file. One keyword per line in the file; lines starting with # are treated as comments and ignored. Suitable for scenarios managing a large number of keywords. Example: # Load SQL injection keywords from file SecRule ARGS "@pmf /etc/wge/sql-keywords.txt" \ "id:1001,phase:2,deny,msg:'SQL keyword detected'" Parameter Type: string (file path)

@pmFromFile

Mon, 01 Jan 0001 00:00:00 +0000

Description: Load keywords from file for parallel matching Syntax: @pmFromFile /path/to/keywords.txt Input Data Type: string (file path) When too many keywords are used in @pm, rules can become very long and difficult to maintain. In that case, @pmFromFile is preferred. It loads all patterns from a file. WGE must have read permission for that file. @pmFromFile and @pm are both implemented with Hyperscan. To enhance @pmFromFile, WGE supports extra control directives in the pattern file:

@rxGlobal

Mon, 01 Jan 0001 00:00:00 +0000

Description: Global regular expression matching (matches all occurrences) Syntax: "@rxGlobal parameter" Example: SecRule ARGS "@rxGlobal ^admin" "id:1001,deny,msg:'Test'" Parameter Type: string (regex) Implementation Status: Not yet implemented

@eq

Mon, 01 Jan 0001 00:00:00 +0000

Description: Numeric equality Syntax: "@eq number" @eq performs numeric equality comparison on the variable value. Variable values are first converted to integers before comparison; non-numeric strings are converted to 0. Commonly used for status code checks, count values, and other exact numeric matching scenarios. Supports dynamic comparison values using macro expansion. Example: # Detect 404 response status SecRule RESPONSE_STATUS "@eq 404" \ "id:1085,phase:3,pass,log,msg:'Page not found'" # Detect empty request body SecRule REQUEST_HEADERS:Content-Length "@eq 0" \ "id:1086,phase:1,pass,nolog,setvar:tx.empty_body=1" # Detect if anomaly score reaches threshold SecRule TX:anomaly_score "@eq %{TX.threshold}" \ "id:1087,phase:2,deny,msg:'Anomaly score reached threshold'" Parameter Type: int

@xor

Mon, 01 Jan 0001 00:00:00 +0000

Description: Numeric XOR Syntax: @xor string Input Data Type: int @xor performs bitwise XOR on the variable value and the parameter. A non-zero XOR result is treated as match. When macro expansion is not used for the parameter, parsing follows the same prefix-parse behavior as @eq. Example: # Content-Length and Transfer-Encoding must not coexist SecRule &REQUEST_HEADERS:Content-Length "!@xor %{&REQUEST_HEADERS:Transfer-Encoding}" \ "id:1085,phase:3,pass,log,msg:'Content-Length and Transfer-Encoding both exist'"

@gt

Mon, 01 Jan 0001 00:00:00 +0000

Description: Greater than Syntax: "@gt number" @gt checks if the variable value (converted to integer) is greater than the specified number. Commonly used for detecting threshold violations such as oversized requests, rate limiting, and anomaly score thresholds. One of the core operators for implementing rate limiting and threshold detection. Example: # Detect oversized request body (exceeds 10MB) SecRule REQUEST_HEADERS:Content-Length "@gt 10485760" \ "id:1088,phase:1,deny,msg:'Request body exceeds size limit'" # Detect anomaly score exceeded SecRule TX:anomaly_score "@gt 10" \ "id:1089,phase:2,deny,msg:'Anomaly score exceeded threshold: %{TX.anomaly_score}'" # Detect IP request rate limit exceeded SecRule IP:request_count "@gt 100" \ "id:1090,phase:1,deny,msg:'IP request rate limit exceeded'" # Detect abnormal parameter count SecRule &ARGS "@gt 100" \ "id:1091,phase:2,deny,msg:'Abnormal parameter count'" Parameter Type: int

@lt

Mon, 01 Jan 0001 00:00:00 +0000

Description: Less than Syntax: "@lt number" @lt checks if the variable value (converted to integer) is less than the specified number. Commonly used for detecting insufficient values such as response status code range detection and minimum length validation scenarios. Can be combined with @gt for range detection. Example: # Detect successful response (status code < 400) SecRule RESPONSE_STATUS "@lt 400" \ "id:1092,phase:3,pass,nolog,setvar:tx.success_response=1" # Detect minimum content length SecRule REQUEST_HEADERS:Content-Length "@lt 10" \ "id:1093,phase:1,pass,nolog,setvar:tx.small_body=1" Parameter Type: int

@ge

Mon, 01 Jan 0001 00:00:00 +0000

Description: Greater than or equal to Syntax: "@ge number" @ge checks if the variable value (converted to integer) is greater than or equal to the specified number. Commonly used for threshold detection, especially determining if cumulative anomaly scores have reached the blocking threshold. Can be combined with @le for closed-interval range detection. Example: # Anomaly score reaches blocking threshold SecRule TX:anomaly_score "@ge 5" \ "id:1095,phase:2,deny,msg:'Anomaly score reached threshold: %{TX.anomaly_score}'" # Detect large file upload SecRule FILES_COMBINED_SIZE "@ge 5242880" \ "id:1096,phase:2,deny,msg:'Total uploaded file size exceeds 5MB'" # Detect brute force (failed attempts >= 5) SecRule IP:failed_login "@ge 5" \ "id:1097,phase:2,deny,msg:'Suspected brute force attack'" Parameter Type: int

@le

Mon, 01 Jan 0001 00:00:00 +0000

Description: Less than or equal to Syntax: "@le number" @le checks if the variable value (converted to integer) is less than or equal to the specified number. Commonly used for upper limit detection such as response status code range checks and request count limits within time windows. Can be combined with @ge for closed-interval range detection. Example: # Detect normal response (status code <= 399) SecRule RESPONSE_STATUS "@le 399" \ "id:1098,phase:3,pass,nolog,setvar:tx.normal_response=1" # Detect requests within rate limit SecRule IP:request_count "@le 100" \ "id:1099,phase:1,pass,nolog" Parameter Type: int

@ipMatch

Mon, 01 Jan 0001 00:00:00 +0000

Description: IP address/CIDR matching Syntax: "@ipMatch ip1,ip2,cidr1,cidr2..." @ipMatch checks if the variable value matches the specified IP address or CIDR range. Supports both IPv4 and IPv6 addresses. Multiple addresses/ranges are separated by commas. Commonly used for IP whitelisting, blacklisting, geo-restrictions, and other access control scenarios. More efficient than using @rx for IP matching. Example: # IP whitelist - allow specific IPs to bypass detection SecRule REMOTE_ADDR "@ipMatch 192.168.1.0/24,10.0.0.0/8" \ "id:1103,phase:1,pass,nolog,ctl:ruleEngine=Off" # IP blacklist - block known malicious IPs SecRule REMOTE_ADDR "@ipMatch 1.2.3.4,5.6.7.8" \ "id:1104,phase:1,deny,msg:'Blacklisted IP address'" # Restrict admin panel access by source IP SecRule REQUEST_URI "@beginsWith /admin" \ "id:1105,phase:1,chain" SecRule REMOTE_ADDR "!@ipMatch 192.168.1.0/24" \ "deny,msg:'Admin panel access from external network forbidden'" # Detect internal IP (possible SSRF attack) SecRule ARGS "@ipMatch 127.0.0.0/8,10.0.0.0/8,172.16.0.0/12,192.168.0.0/16" \ "id:1106,phase:2,deny,msg:'Internal IP access detected, possible SSRF'" Parameter Type: string

@ipMatchF

Mon, 01 Jan 0001 00:00:00 +0000

Description: Short form of @ipMatchFromFile Syntax: @ipMatchF file_path Input Data Type: string Implementation Status: Not yet implemented WGE can parse this directive, but the feature is not implemented yet. Example: # Load IP blacklist from file SecRule REMOTE_ADDR "@ipMatchF /etc/wge/ip-blacklist.txt" \ "id:1107,phase:1,deny,msg:'IP is in blacklist'" # Load trusted proxy IP list from file SecRule REMOTE_ADDR "@ipMatchF /etc/wge/trusted-proxies.txt" \ "id:1108,phase:1,pass,nolog,setvar:tx.is_trusted_proxy=1"

@ipMatchFromFile

Mon, 01 Jan 0001 00:00:00 +0000

Description: Load IP address list from file for matching Syntax: "@ipMatchFromFile parameter" Example: SecRule ARGS "@ipMatchFromFile 192.168.1.1" "id:1001,deny,msg:'Test'" Parameter Type: string (file path) Implementation Status: Not yet implemented

@validateByteRange

Mon, 01 Jan 0001 00:00:00 +0000

Description: Validate included bytes Syntax: @validateByteRange range1,range2-range3,... Input Data Type: string Case Sensitive: Yes @validateByteRange checks whether each byte of the input falls within the specified range set. It supports single values (for example 10) and ranges (for example 32-126) separated by commas. It matches when bytes outside the allowed ranges are found. It is commonly used to detect NUL bytes (0x00), non-printable characters, and binary-like payloads. Note: Parameters are parsed as positive integers using prefix parsing. For example, 10ab is parsed as 10; invalid forms such as -100 are parsed as 0. Values greater than 256 are dropped. If range start is greater than range end (for example 100-20), that range is dropped. Example:

@validateUrlEncoding

Mon, 01 Jan 0001 00:00:00 +0000

Description: Validate URL encoding Syntax: "@validateUrlEncoding" @validateUrlEncoding checks if URL encoding (percent-encoding) in the variable value is valid. Matches if invalid URL encoding is found. This operator detects attacks using invalid URL encoding for detection evasion, such as malformed encoding like %ZZ or %1. Requires no parameters. Example: # Detect invalid URL encoding SecRule ARGS "@validateUrlEncoding" \ "id:1113,phase:2,deny,msg:'Invalid URL encoding detected'" # Detect invalid encoding in URI SecRule REQUEST_URI "@validateUrlEncoding" \ "id:1114,phase:1,deny,msg:'Invalid URL encoding in URI'" # Detect encoding issues in query string SecRule QUERY_STRING "@validateUrlEncoding" \ "id:1115,phase:1,deny,msg:'Invalid encoding in query string'" Parameter Type: none

@validateUtf8Encoding

Mon, 01 Jan 0001 00:00:00 +0000

Description: Validate UTF-8 encoding Syntax: "@validateUtf8Encoding parameter" Example: SecRule ARGS "@validateUtf8Encoding parameter" "id:1001,deny,msg:'Test'" Parameter Type: none Implementation Status: Not yet implemented

@validateDtd

Mon, 01 Jan 0001 00:00:00 +0000

Description: Validate XML against DTD Syntax: "@validateDtd parameter" Example: SecRule ARGS "@validateDtd parameter" "id:1001,deny,msg:'Test'" Parameter Type: string Implementation Status: Not yet implemented

@validateSchema

Mon, 01 Jan 0001 00:00:00 +0000

Description: Validate XML against Schema Syntax: "@validateSchema parameter" Example: SecRule ARGS "@validateSchema parameter" "id:1001,deny,msg:'Test'" Parameter Type: string Implementation Status: Not yet implemented

@verifyCc

Mon, 01 Jan 0001 00:00:00 +0000

Description: Verify credit card number Syntax: "@verifyCc parameter" Example: SecRule ARGS "@verifyCc parameter" "id:1001,deny,msg:'Test'" Parameter Type: string (regex) Implementation Status: Not yet implemented

@verifyCpf

Mon, 01 Jan 0001 00:00:00 +0000

Description: Verify Brazilian CPF number Syntax: "@verifyCpf parameter" Example: SecRule ARGS "@verifyCpf parameter" "id:1001,deny,msg:'Test'" Parameter Type: string (regex) Implementation Status: Not yet implemented

@verifySsn

Mon, 01 Jan 0001 00:00:00 +0000

Description: Verify US Social Security Number Syntax: "@verifySsn parameter" Example: SecRule ARGS "@verifySsn parameter" "id:1001,deny,msg:'Test'" Parameter Type: string (regex) Implementation Status: Not yet implemented

@detectSQLi

Mon, 01 Jan 0001 00:00:00 +0000

Description: Detects SQL injection attacks using the libinjection library Syntax: "@detectSQLi" @detectSQLi uses libinjection’s SQL injection detection engine to identify SQL injection patterns through lexical analysis and fingerprint matching. Compared to regex-based detection, libinjection provides lower false positive rates and higher detection accuracy. This operator requires no parameters. Example: # Detect SQL injection in all parameters SecRule ARGS "@detectSQLi" \ "id:1001,phase:2,deny,msg:'SQL Injection Attack Detected'" # Combined with variable detection SecRule ARGS|REQUEST_HEADERS "@detectSQLi" \ "id:1002,phase:2,deny,severity:CRITICAL,\ msg:'SQL Injection detected in %{MATCHED_VAR_NAME}'" Parameter Type: none

@detectXSS

Mon, 01 Jan 0001 00:00:00 +0000

Description: Detects Cross-Site Scripting (XSS) attacks using the libinjection library Syntax: "@detectXSS" @detectXSS uses libinjection’s XSS detection engine to detect XSS attacks by identifying HTML and JavaScript injection patterns. It can detect various types of XSS including reflected, stored, and DOM-based XSS. This operator requires no parameters. Example: # Detect XSS attacks in parameters SecRule ARGS "@detectXSS" \ "id:1001,phase:2,deny,msg:'XSS Attack Detected'" # Detect XSS in request body SecRule REQUEST_BODY "@detectXSS" \ "id:1002,phase:2,deny,severity:CRITICAL,\ msg:'XSS Attack in request body'" Parameter Type: none

@unconditionalMatch

Mon, 01 Jan 0001 00:00:00 +0000

Description: Unconditional match (always returns true) Syntax: @unconditionalMatch Input Data Type: int|string @unconditionalMatch always returns match. It is related to @noMatch: when negated (for example !@unconditionalMatch), behavior is equivalent to @noMatch. Example: # Use in rule chain SecRule ARGS "@rx user" \ "id:1118,phase:1,chain,pass" SecRule &MATCHED_VARS "@unconditionalMatch" \ "setvar:tx.is_post_request+=1"

@noMatch

Mon, 01 Jan 0001 00:00:00 +0000

Description: No match Syntax: @noMatch Input Data Type: int|string Case Sensitive: Yes @noMatch always returns no match. When negation is used, behavior becomes unconditional match, which is equivalent to @unconditionalMatch.

@inspectFile

Mon, 01 Jan 0001 00:00:00 +0000

Description: Invoke external script to inspect file Syntax: "@inspectFile parameter" Example: SecRule ARGS "@inspectFile parameter" "id:1001,deny,msg:'Test'" Parameter Type: string (file path) Implementation Status: Not yet implemented

@fuzzyHash

Mon, 01 Jan 0001 00:00:00 +0000

Description: Fuzzy hash matching Syntax: "@fuzzyHash parameter" Example: SecRule ARGS "@fuzzyHash parameter" "id:1001,deny,msg:'Test'" Parameter Type: string Implementation Status: Not yet implemented

@geoLookup

Mon, 01 Jan 0001 00:00:00 +0000

Description: Geolocation lookup Syntax: "@geoLookup parameter" Example: SecRule ARGS "@geoLookup parameter" "id:1001,deny,msg:'Test'" Parameter Type: none Implementation Status: Not yet implemented

@rbl

Mon, 01 Jan 0001 00:00:00 +0000

Description: Real-time blacklist lookup Syntax: "@rbl parameter" Example: SecRule ARGS "@rbl parameter" "id:1001,deny,msg:'Test'" Parameter Type: string Implementation Status: Not yet implemented

@rsub

Mon, 01 Jan 0001 00:00:00 +0000

Description: Regular expression substitution Syntax: "@rsub parameter" Example: SecRule ARGS "@rsub parameter" "id:1001,deny,msg:'Test'" Parameter Type: string Implementation Status: Not yet implemented