[{"id":1,"actions":[{"type":"INSPECT"}],"min_rule_engine_ver":0.1,"rule_logic":{"type":"OR","left_operand":{"type":"FUNCTION","name":"match","args":[{"type":"STRING","value":"/phar:\\/\\//i"},{"type":"FUNCTION","name":"getPostParams","args":[]}]},"right_operand":{"type":"FUNCTION","name":"match","args":[{"type":"STRING","value":"/phar:\\/\\//i"},{"type":"FUNCTION","name":"getGetParams","args":[]}]}},"level":null},{"id":2,"actions":[{"type":"INSPECT"}],"min_rule_engine_ver":0.1,"rule_logic":{"type":"OR","left_operand":{"type":"FUNCTION","name":"greaterThan","args":[{"type":"NUMBER","value":0},{"type":"FUNCTION","name":"matchCount","args":[{"type":"STRING","value":"/(^|;|{|})O:+?\\+*[0-9]+:\"WP_Theme\"/i"},{"type":"FUNCTION","name":"getPostParams","args":[]}]}]},"right_operand":{"type":"FUNCTION","name":"greaterThan","args":[{"type":"NUMBER","value":0},{"type":"FUNCTION","name":"matchCount","args":[{"type":"STRING","value":"/(^|;|{|})O:+?\\+*[0-9]+:\"WP_Theme\"/i"},{"type":"FUNCTION","name":"getGetParams","args":[]}]}]}},"level":null},{"id":4,"actions":[{"type":"INSPECT"},{"type":"BLOCK"}],"min_rule_engine_ver":0.1,"rule_logic":{"type":"OR","left_operand":{"type":"FUNCTION","name":"match","args":[{"type":"STRING","value":"/(^|\\/|\\\\)(\\.\\.?(\\\\|\\/)+)+wp\\-config\\.php/i"},{"type":"FUNCTION","name":"getPostParams","args":[]}]},"right_operand":{"type":"FUNCTION","name":"match","args":[{"type":"STRING","value":"/(^|\\/|\\\\)(\\.\\.?(\\\\|\\/)+)+wp\\-config\\.php/i"},{"type":"FUNCTION","name":"getGetParams","args":[]}]}},"level":null},{"id":5,"actions":[{"type":"INSPECT"},{"type":"BLOCK"}],"min_rule_engine_ver":0.1,"rule_logic":{"type":"FUNCTION","name":"match","args":[{"type":"STRING","value":"/\\.(p(h(pt?|t(ml?)?|ar)[0-9]?|l|y)|(j|a)sp|aspx|sh|shtml|html?|cgi|htaccess|user\\.ini)($|\\.)/i"},{"type":"FUNCTION","name":"getFileNames","args":[]}]},"level":null},{"id":6,"actions":[{"type":"INSPECT"},{"type":"BLOCK"}],"min_rule_engine_ver":0.1,"rule_logic":{"type":"OR","left_operand":{"type":"FUNCTION","name":"match","args":[{"type":"STRING","value":"/^\\/(?:\\.\\/)*(?:var|home|usr|mnt|media|etc|tmp|dev|proc)\\//i"},{"type":"FUNCTION","name":"getPostParams","args":[]}]},"right_operand":{"type":"FUNCTION","name":"match","args":[{"type":"STRING","value":"/^\\/(?:\\.\\/)*(?:var|home|usr|mnt|media|etc|tmp|dev|proc)\\//i"},{"type":"FUNCTION","name":"getGetParams","args":[]}]}},"level":null},{"id":7,"actions":[{"type":"INSPECT"}],"min_rule_engine_ver":0.1,"rule_logic":{"type":"OR","left_operand":{"type":"FUNCTION","name":"match","args":[{"type":"STRING","value":"/<\\!(?:DOCTYPE|ENTITY)\\s+(?:%\\s*)?\\w+\\s+SYSTEM/i"},{"type":"FUNCTION","name":"getPostParams","args":[]}]},"right_operand":{"type":"FUNCTION","name":"match","args":[{"type":"STRING","value":"/<\\!(?:DOCTYPE|ENTITY)\\s+(?:%\\s*)?\\w+\\s+SYSTEM/i"},{"type":"FUNCTION","name":"getGetParams","args":[]}]}},"level":null},{"id":8,"actions":[{"type":"INSPECT"}],"min_rule_engine_ver":0.1,"rule_logic":{"type":"OR","left_operand":{"type":"FUNCTION","name":"match","args":[{"type":"STRING","value":"/(^|\\/|\\\\)\\.\\.(\\\\|\\/)/"},{"type":"FUNCTION","name":"getPostParams","args":[]}]},"right_operand":{"type":"FUNCTION","name":"match","args":[{"type":"STRING","value":"/(^|\\/|\\\\)\\.\\.(\\\\|\\/)/"},{"type":"FUNCTION","name":"getGetParams","args":[]}]}},"level":null},{"id":9,"actions":[{"type":"INSPECT"}],"min_rule_engine_ver":0.1,"rule_logic":{"type":"OR","left_operand":{"type":"FUNCTION","name":"greaterThan","args":[{"type":"NUMBER","value":2},{"type":"FUNCTION","name":"maxMatchCount","args":[{"type":"CONST","value":"BVFW::SQLIREGEX"},{"type":"FUNCTION","name":"getPostParams","args":[]}]}]},"right_operand":{"type":"FUNCTION","name":"greaterThan","args":[{"type":"NUMBER","value":2},{"type":"FUNCTION","name":"maxMatchCount","args":[{"type":"CONST","value":"BVFW::SQLIREGEX"},{"type":"FUNCTION","name":"getGetParams","args":[]}]}]}},"level":null},{"id":10,"actions":[{"type":"INSPECT"},{"type":"BLOCK"}],"min_rule_engine_ver":0.1,"rule_logic":{"type":"FUNCTION","name":"match","args":[{"type":"CONST","value":"BVFW::XSSREGEX"},{"type":"FUNCTION","name":"getGetParams","args":[]}]},"level":null},{"id":11,"actions":[{"type":"INSPECT"}],"min_rule_engine_ver":0.1,"rule_logic":{"type":"FUNCTION","name":"match","args":[{"type":"CONST","value":"BVFW::XSSREGEX"},{"type":"FUNCTION","name":"getHeaders","args":[]}]},"level":null},{"id":12,"actions":[{"type":"INSPECT"},{"type":"BLOCK"}],"min_rule_engine_ver":0.1,"rule_logic":{"type":"OR","left_operand":{"type":"FUNCTION","name":"match","args":[{"type":"STRING","value":"/union(\\s|\\/\\*.*\\*\\/)(all(\\s|\\/\\*.*\\*\\/)|)select/ix"},{"type":"FUNCTION","name":"getPostParams","args":[]}]},"right_operand":{"type":"FUNCTION","name":"match","args":[{"type":"STRING","value":"/union(\\s|\\/\\*.*\\*\\/)(all(\\s|\\/\\*.*\\*\\/)|)select/ix"},{"type":"FUNCTION","name":"getGetParams","args":[]}]}},"level":null},{"id":13,"actions":[{"type":"INSPECT"},{"type":"BLOCK"}],"min_rule_engine_ver":0.1,"rule_logic":{"type":"OR","left_operand":{"type":"FUNCTION","name":"match","args":[{"type":"STRING","value":"/order(\\s|\\/\\*.*\\*\\/)by(\\s|\\/\\*.*\\*\\/).*(\\-\\-.|#)/i"},{"type":"FUNCTION","name":"getPostParams","args":[]}]},"right_operand":{"type":"FUNCTION","name":"match","args":[{"type":"STRING","value":"/order(\\s|\\/\\*.*\\*\\/)by(\\s|\\/\\*.*\\*\\/).*(\\-\\-.|#)/i"},{"type":"FUNCTION","name":"getGetParams","args":[]}]}},"level":null},{"id":14,"actions":[{"type":"INSPECT"},{"type":"BLOCK"}],"min_rule_engine_ver":0.1,"rule_logic":{"type":"OR","left_operand":{"type":"FUNCTION","name":"match","args":[{"type":"STRING","value":"/information_schema/ix"},{"type":"FUNCTION","name":"getPostParams","args":[]}]},"right_operand":{"type":"FUNCTION","name":"match","args":[{"type":"STRING","value":"/information_schema/ix"},{"type":"FUNCTION","name":"getGetParams","args":[]}]}},"level":null},{"id":15,"actions":[{"type":"INSPECT"},{"type":"BLOCK"}],"min_rule_engine_ver":0.1,"rule_logic":{"type":"OR","left_operand":{"type":"FUNCTION","name":"match","args":[{"type":"STRING","value":"/(\\s|\\.)(wp_actionscheduler_actions|wp_actionscheduler_claims|wp_actionscheduler_groups|wp_actionscheduler_logs|wp_bv_activities_store|wp_bv_fw_requests|wp_bv_ip_store|wp_bv_lp_requests|wp_ce4wp_abandoned_checkout|wp_ce4wp_contacts|wp_commentmeta|wp_comments|wp_defender_audit_log|wp_defender_email_log|wp_defender_lockout|wp_defender_lockout_log|wp_defender_quarantine|wp_defender_scan|wp_defender_scan_item|wp_dopbsp_api_keys|wp_dopbsp_availability|wp_dopbsp_availability_no|wp_dopbsp_availability_price|wp_dopbsp_calendars|wp_dopbsp_coupons|wp_dopbsp_days|wp_dopbsp_discounts|wp_dopbsp_discounts_items|wp_dopbsp_discounts_items_rules|wp_dopbsp_emails|wp_dopbsp_emails_translation|wp_dopbsp_extras|wp_dopbsp_extras_groups|wp_dopbsp_extras_groups_items|wp_dopbsp_fees|wp_dopbsp_forms|wp_dopbsp_forms_fields|wp_dopbsp_forms_select_options|wp_dopbsp_languages|wp_dopbsp_locations|wp_dopbsp_models|wp_dopbsp_reservations|wp_dopbsp_rules|wp_dopbsp_searches|wp_dopbsp_settings|wp_dopbsp_settings_calendar|wp_dopbsp_settings_notifications|wp_dopbsp_settings_payment|wp_dopbsp_settings_search|wp_dopbsp_smses|wp_dopbsp_smses_translation|wp_dopbsp_translation_en|wp_dopbsp_woocommerce|wp_duplicator_packages|wp_e_events|wp_e_submissions|wp_e_submissions_actions_log|wp_e_submissions_values|wp_links|wp_litespeed_url|wp_litespeed_url_file|wp_mailchimp_carts|wp_mailchimp_jobs|wp_mailpoet_custom_fields|wp_mailpoet_dynamic_segment_filters|wp_mailpoet_feature_flags|wp_mailpoet_forms|wp_mailpoet_log|wp_mailpoet_mapping_to_external_entities|wp_mailpoet_newsletter_links|wp_mailpoet_newsletter_option|wp_mailpoet_newsletter_option_fields|wp_mailpoet_newsletter_posts|wp_mailpoet_newsletter_segment|wp_mailpoet_newsletter_templates|wp_mailpoet_newsletters|wp_mailpoet_scheduled_task_subscribers|wp_mailpoet_scheduled_tasks|wp_mailpoet_segments|wp_mailpoet_sending_queues|wp_mailpoet_settings|wp_mailpoet_statistics_clicks|wp_mailpoet_statistics_forms|wp_mailpoet_statistics_newsletters|wp_mailpoet_statistics_opens|wp_mailpoet_statistics_unsubscribes|wp_mailpoet_statistics_woocommerce_purchases|wp_mailpoet_stats_notifications|wp_mailpoet_subscriber_custom_field|wp_mailpoet_subscriber_ips|wp_mailpoet_subscriber_segment|wp_mailpoet_subscribers|wp_mailpoet_user_agents|wp_mailpoet_user_flags|wp_nx_entries|wp_nx_posts|wp_nx_stats|wp_options|wp_postmeta|wp_posts|wp_rnb_availability|wp_rnb_inventory_product|wp_social_users|wp_term_relationships|wp_term_taxonomy|wp_termmeta|wp_terms|wp_usermeta|wp_users|wp_wc_admin_note_actions|wp_wc_admin_notes|wp_wc_booking_relationships|wp_wc_bookings_availability|wp_wc_bookings_availabilitymeta|wp_wc_category_lookup|wp_wc_customer_lookup|wp_wc_download_log|wp_wc_order_coupon_lookup|wp_wc_order_product_lookup|wp_wc_order_stats|wp_wc_order_tax_lookup|wp_wc_product_attributes_lookup|wp_wc_product_download_directories|wp_wc_product_meta_lookup|wp_wc_rate_limits|wp_wc_reserved_stock|wp_wc_tax_rate_classes|wp_wc_webhooks|wp_wfblockediplog|wp_wfblocks7|wp_wfconfig|wp_wfcrawlers|wp_wffilechanges|wp_wffilemods|wp_wfhits|wp_wfhoover|wp_wfissues|wp_wfknownfilelist|wp_wflivetraffichuman|wp_wflocs|wp_wflogins|wp_wfls_2fa_secrets|wp_wfls_role_counts|wp_wfls_settings|wp_wfnotifications|wp_wfpendingissues|wp_wfreversecache|wp_wfsecurityevents|wp_wfsnipcache|wp_wfstatus|wp_wftrafficrates|wp_wfwaffailures|wp_woocommerce_api_keys|wp_woocommerce_attribute_taxonomies|wp_woocommerce_downloadable_product_permissions|wp_woocommerce_log|wp_woocommerce_order_itemmeta|wp_woocommerce_order_items|wp_woocommerce_payment_tokenmeta|wp_woocommerce_payment_tokens|wp_woocommerce_sessions|wp_woocommerce_shipping_zone_locations|wp_woocommerce_shipping_zone_methods|wp_woocommerce_shipping_zones|wp_woocommerce_tax_rate_locations|wp_woocommerce_tax_rates|wp_wp_phpmyadmin_extension__errors_log|wp_wpfm_backup|wp_wpsetts|wp_yith_wcwl|wp_yith_wcwl_lists)(\\b|\\.|\\-\\-\\s|#)/i"},{"type":"FUNCTION","name":"getPostParams","args":[]}]},"right_operand":{"type":"FUNCTION","name":"match","args":[{"type":"STRING","value":"/(\\s|\\.)(wp_actionscheduler_actions|wp_actionscheduler_claims|wp_actionscheduler_groups|wp_actionscheduler_logs|wp_bv_activities_store|wp_bv_fw_requests|wp_bv_ip_store|wp_bv_lp_requests|wp_ce4wp_abandoned_checkout|wp_ce4wp_contacts|wp_commentmeta|wp_comments|wp_defender_audit_log|wp_defender_email_log|wp_defender_lockout|wp_defender_lockout_log|wp_defender_quarantine|wp_defender_scan|wp_defender_scan_item|wp_dopbsp_api_keys|wp_dopbsp_availability|wp_dopbsp_availability_no|wp_dopbsp_availability_price|wp_dopbsp_calendars|wp_dopbsp_coupons|wp_dopbsp_days|wp_dopbsp_discounts|wp_dopbsp_discounts_items|wp_dopbsp_discounts_items_rules|wp_dopbsp_emails|wp_dopbsp_emails_translation|wp_dopbsp_extras|wp_dopbsp_extras_groups|wp_dopbsp_extras_groups_items|wp_dopbsp_fees|wp_dopbsp_forms|wp_dopbsp_forms_fields|wp_dopbsp_forms_select_options|wp_dopbsp_languages|wp_dopbsp_locations|wp_dopbsp_models|wp_dopbsp_reservations|wp_dopbsp_rules|wp_dopbsp_searches|wp_dopbsp_settings|wp_dopbsp_settings_calendar|wp_dopbsp_settings_notifications|wp_dopbsp_settings_payment|wp_dopbsp_settings_search|wp_dopbsp_smses|wp_dopbsp_smses_translation|wp_dopbsp_translation_en|wp_dopbsp_woocommerce|wp_duplicator_packages|wp_e_events|wp_e_submissions|wp_e_submissions_actions_log|wp_e_submissions_values|wp_links|wp_litespeed_url|wp_litespeed_url_file|wp_mailchimp_carts|wp_mailchimp_jobs|wp_mailpoet_custom_fields|wp_mailpoet_dynamic_segment_filters|wp_mailpoet_feature_flags|wp_mailpoet_forms|wp_mailpoet_log|wp_mailpoet_mapping_to_external_entities|wp_mailpoet_newsletter_links|wp_mailpoet_newsletter_option|wp_mailpoet_newsletter_option_fields|wp_mailpoet_newsletter_posts|wp_mailpoet_newsletter_segment|wp_mailpoet_newsletter_templates|wp_mailpoet_newsletters|wp_mailpoet_scheduled_task_subscribers|wp_mailpoet_scheduled_tasks|wp_mailpoet_segments|wp_mailpoet_sending_queues|wp_mailpoet_settings|wp_mailpoet_statistics_clicks|wp_mailpoet_statistics_forms|wp_mailpoet_statistics_newsletters|wp_mailpoet_statistics_opens|wp_mailpoet_statistics_unsubscribes|wp_mailpoet_statistics_woocommerce_purchases|wp_mailpoet_stats_notifications|wp_mailpoet_subscriber_custom_field|wp_mailpoet_subscriber_ips|wp_mailpoet_subscriber_segment|wp_mailpoet_subscribers|wp_mailpoet_user_agents|wp_mailpoet_user_flags|wp_nx_entries|wp_nx_posts|wp_nx_stats|wp_options|wp_postmeta|wp_posts|wp_rnb_availability|wp_rnb_inventory_product|wp_social_users|wp_term_relationships|wp_term_taxonomy|wp_termmeta|wp_terms|wp_usermeta|wp_users|wp_wc_admin_note_actions|wp_wc_admin_notes|wp_wc_booking_relationships|wp_wc_bookings_availability|wp_wc_bookings_availabilitymeta|wp_wc_category_lookup|wp_wc_customer_lookup|wp_wc_download_log|wp_wc_order_coupon_lookup|wp_wc_order_product_lookup|wp_wc_order_stats|wp_wc_order_tax_lookup|wp_wc_product_attributes_lookup|wp_wc_product_download_directories|wp_wc_product_meta_lookup|wp_wc_rate_limits|wp_wc_reserved_stock|wp_wc_tax_rate_classes|wp_wc_webhooks|wp_wfblockediplog|wp_wfblocks7|wp_wfconfig|wp_wfcrawlers|wp_wffilechanges|wp_wffilemods|wp_wfhits|wp_wfhoover|wp_wfissues|wp_wfknownfilelist|wp_wflivetraffichuman|wp_wflocs|wp_wflogins|wp_wfls_2fa_secrets|wp_wfls_role_counts|wp_wfls_settings|wp_wfnotifications|wp_wfpendingissues|wp_wfreversecache|wp_wfsecurityevents|wp_wfsnipcache|wp_wfstatus|wp_wftrafficrates|wp_wfwaffailures|wp_woocommerce_api_keys|wp_woocommerce_attribute_taxonomies|wp_woocommerce_downloadable_product_permissions|wp_woocommerce_log|wp_woocommerce_order_itemmeta|wp_woocommerce_order_items|wp_woocommerce_payment_tokenmeta|wp_woocommerce_payment_tokens|wp_woocommerce_sessions|wp_woocommerce_shipping_zone_locations|wp_woocommerce_shipping_zone_methods|wp_woocommerce_shipping_zones|wp_woocommerce_tax_rate_locations|wp_woocommerce_tax_rates|wp_wp_phpmyadmin_extension__errors_log|wp_wpfm_backup|wp_wpsetts|wp_yith_wcwl|wp_yith_wcwl_lists)(\\b|\\.|\\-\\-\\s|#)/i"},{"type":"FUNCTION","name":"getGetParams","args":[]}]}},"level":null},{"id":16,"actions":[{"type":"INSPECT"},{"type":"BLOCK"}],"min_rule_engine_ver":0.1,"rule_logic":{"type":"AND","left_operand":{"type":"FUNCTION","name":"match","args":[{"type":"CONST","value":"BVFW::XSSREGEX"},{"type":"FUNCTION","name":"getPostParams","args":[]}]},"right_operand":{"type":"FUNCTION","name":"notMatch","args":[{"type":"STRING","value":"/rocket_saas_warmup|rocket_rucss_warmup_resource_fetcher|fpd_product/ix"},{"type":"FUNCTION","name":"getPostParams","args":[]}]}},"level":null}]