Add Moodle detection rules for web server logs

Author: sankettaware16

rules/web/product/moodle/web_moodle_cron_endpoint_external_access.yml

@@ -0,0 +1,35 @@
+title: Moodle Cron Endpoint Accessed From External Address
+id: eb36448d-2512-482d-ad99-9feab85ef500
+status: experimental
+description: |
+    Detects requests to Moodle's web cron endpoint from an address outside RFC1918 space.
+    Moodle documentation recommends restricting web cron to the local host or to a defined set of
+    trusted addresses. Where it is left open, an unauthenticated attacker can repeatedly trigger the
+    full scheduled task run, which is both a denial of service primitive and a way to force execution
+    of tasks registered by an installed plugin.
+references:
+    - https://docs.moodle.org/en/Cron
+    - https://docs.moodle.org/en/Site_security_settings
+author: Sanket Taware (@sankettaware16)
+date: 2026-07-31
+tags:
+    - attack.execution
+    - attack.persistence
+    - attack.privilege-escalation
+    - attack.t1053
+logsource:
+    category: webserver
+detection:
+    selection:
+        cs-uri-stem|endswith: '/admin/cron.php'
+    filter_main_internal:
+        c-ip|cidr:
+            - '127.0.0.0/8'
+            - '10.0.0.0/8'
+            - '172.16.0.0/12'
+            - '192.168.0.0/16'
+    condition: selection and not 1 of filter_main_*
+falsepositives:
+    - Sites that deliberately drive web cron from an external scheduler or uptime monitor
+    - Reverse proxies and load balancers that do not preserve the original client address, which will make every request appear external
+level: high

rules/web/product/moodle/web_moodle_executable_download_from_file_storage.yml

@@ -0,0 +1,48 @@
+title: Executable Or Script File Served From Moodle File Storage
+id: 98afeaf3-7305-42d9-8ea9-a9c968d903e7
+status: experimental
+description: |
+    Detects successful downloads of executable or script file types through Moodle's file serving
+    endpoints. Course files, assignment submissions and draft areas accept arbitrary uploads from any
+    enrolled user, which makes a Moodle site an attractive and highly trusted distribution point for
+    malware aimed at other members of the institution.
+references:
+    - https://docs.moodle.org/dev/File_API
+    - https://docs.moodle.org/en/Site_security_settings
+author: Sanket Taware (@sankettaware16)
+date: 2026-07-31
+tags:
+    - attack.execution
+    - attack.t1204.002
+logsource:
+    category: webserver
+detection:
+    selection_endpoint:
+        cs-uri-stem|contains:
+            - '/pluginfile.php'
+            - '/draftfile.php'
+            - '/tokenpluginfile.php'
+            - '/webservice/pluginfile.php'
+    selection_extension:
+        cs-uri-stem|endswith:
+            - '.bat'
+            - '.chm'
+            - '.cmd'
+            - '.exe'
+            - '.hta'
+            - '.jar'
+            - '.lnk'
+            - '.msi'
+            - '.ps1'
+            - '.scr'
+            - '.vbe'
+            - '.vbs'
+            - '.wsf'
+    selection_status:
+        sc-status: 200
+    condition: all of selection_*
+falsepositives:
+    - Programming, systems or security courses that distribute compiled binaries, JAR files or scripts as teaching material
+    - Software packaged as a course resource by teaching staff
+    - Assignment briefs that require students to submit compiled artefacts
+level: medium

rules/web/product/moodle/web_moodle_php_execution_in_upload_path.yml

@@ -0,0 +1,37 @@
+title: PHP File Served From Moodle Upload Or Static Content Path
+id: 28b7d590-3fb1-4cca-b67b-c74ee2dc904d
+status: experimental
+description: |
+    Detects a successful request for a .php file located under a Moodle directory that should only ever
+    serve uploaded content or static assets. Moodle deliberately stores uploaded files outside the web
+    root and serves them through pluginfile.php, so a PHP file answering with 200 from one of these
+    paths means either the data directory has been exposed to the web server or a script has been
+    written into the document root - both of which are consistent with a web shell.
+    A 200 response for anything under the Moodle data directory is a serious misconfiguration in its own
+    right and should be investigated even if the file is not PHP.
+references:
+    - https://docs.moodle.org/en/Security_recommendations
+    - https://docs.moodle.org/dev/File_API
+author: Sanket Taware (@sankettaware16)
+date: 2026-07-31
+tags:
+    - attack.persistence
+    - attack.t1505.003
+logsource:
+    category: webserver
+detection:
+    selection_extension:
+        cs-uri-stem|endswith: '.php'
+    selection_path:
+        cs-uri-stem|contains:
+            - '/moodledata/'
+            - '/filedir/'
+            - '/pix/'
+            - '/userpix/'
+            - '/repository/draftfiles/'
+    selection_status:
+        sc-status: 200
+    condition: all of selection_*
+falsepositives:
+    - A theme or plugin that ships a PHP file under a pix directory - verify against the plugin source before excluding
+level: high