On this page

Atomicorp WAF Rule 397989

Rule Summary

  • Rule ID: 397989
  • Status: Active
  • Alert message: Atomicorp.com WAF Rules: MSIE 6.0 detected (Disable if you want to allow MSIE 6)
  • Observed CWEs: None documented
  • Revision: 1
  • Rule severity: Warning (4)
  • Phase: 2 (request body)
  • Request surfaces: Request headers
  • Rule action: deny
  • Logging: log, auditlog

Description

This rule detects when I client pretends to be using Microsoft Internet Explorer 6.0. Many malicious bots and attackers will try to disguise their requests as legitimate users, and this rules detects when the request has been faked. This types of requests should be blocked.

False Positives

No none false positives with this rule.

It is not recommended that you disable this rule if you have a false positive. If you believe this is a false positive, please report this to our security team to determine if this is a legitimate case, or if its clever attack on your system. Instructions to report false positives are detailed on the Reporting False Positives wiki page. If it is a false positive, we will fix the issue in the rules and get a release out to you promptly.

Tuning Guidance

Please see the Tuning the Atomicorp WAF Rules page for basic information.

This is a selected list of documented research observations, not an exhaustive coverage matrix. Absence of a CVE does not imply absence of protection.

No selected related public CVE research notes are currently published.

Documentation Source

  • Original wiki page: WAF 397989
  • Source revision: 5692
  • Source revision date: 2016-04-26