Panther rules: cloudflare

from panther_cloudflare_helpers import cloudflare_http_alert_context


def rule(event):
    # Bot scores are [0, 99] where scores >0 && <30 indicating likely automated
    # https://developers.cloudflare.com/bots/concepts/bot-score/
    return all(
        [
            event.get("BotScore", 100) <= 30,
            event.get("BotScore", 100) >= 1,
        ]
    )


def title(event):
    return (
        f"Cloudflare: High Volume of Bot Requests "
        f"to [{event.get('ClientRequestHost', '<NO_REQ_HOST>')}]"
    )


def alert_context(event):
    return cloudflare_http_alert_context(event)

AnalysisType: rule
Filename: cloudflare_httpreq_bot_high_volume.py
RuleID: "Cloudflare.HttpRequest.BotHighVolume"
DisplayName: "Cloudflare Bot High Volume"
Enabled: false
LogTypes:
  - Cloudflare.HttpRequest
Tags:
  - Cloudflare
Severity: Low
Description: Monitors for bots making HTTP Requests at a rate higher than 2req/sec
Runbook: Inspect and monitor internet-facing services for potential outages
Reference: https://developers.cloudflare.com/waf/rate-limiting-rules/request-rate/
DedupPeriodMinutes: 60 # 1 hour
Threshold: 7560 # 2req/sec is 7200 + 5% for just-in-case
SummaryAttributes:
  - ClientIP
  - ClientRequestUserAgent
  - EdgeResponseContentType
  - ClientCountry
  - ClientRequestURI

from panther_cloudflare_helpers import cloudflare_fw_alert_context


def rule(event):

    return event.get("Source", "") == "l7ddos"


def title(_):
    return "Cloudflare: Detected L7 DDoS"


def alert_context(event):
    return cloudflare_fw_alert_context(event)


def severity(event):
    if event.get("Action", "") == "block":
        return "Info"
    return "Medium"

AnalysisType: rule
Filename: cloudflare_firewall_ddos.py
RuleID: "Cloudflare.Firewall.L7DDoS"
DisplayName: "Cloudflare L7 DDoS"
Enabled: true
LogTypes:
  - Cloudflare.Firewall
Tags:
  - Cloudflare
  - Variable Severity
Severity: Medium
Description: Layer 7 Distributed Denial of Service (DDoS) detected
Runbook: Inspect and monitor internet-facing services for potential outages
Reference: https://www.cloudflare.com/en-gb/learning/ddos/application-layer-ddos-attack/
DedupPeriodMinutes: 60 # 1 hour
Threshold: 100
SummaryAttributes:
  - Action
  - ClientCountry
  - ClientIP
  - ClientRequestUserAgent

from panther_cloudflare_helpers import cloudflare_fw_alert_context

# Cloudflare Rule IDs for CVE-2025-55182
REACT2SHELL_RULE_IDS = [
    "33aa8a8a948b48b28d40450c5fb92fba",  # Managed Ruleset
    "2b5d06e34a814a889bee9a0699702280",  # Free Ruleset
]


def rule(event):
    rule_id = event.get("RuleID", "")
    return rule_id in REACT2SHELL_RULE_IDS


def title(event):
    client_ip = event.get("ClientIP", "<UNKNOWN_IP>")
    return f"Cloudflare React2Shell (CVE-2025-55182) Exploit Detected from [{client_ip}]"


def alert_context(event):
    return cloudflare_fw_alert_context(event)

AnalysisType: rule
Filename: cloudflare_react2shell_rce_attempt.py
RuleID: "Cloudflare.Firewall.React2Shell.RCE"
DisplayName: "Cloudflare React2Shell RCE Attempt Detected"
Enabled: true
LogTypes:
  - Cloudflare.Firewall
Tags:
  - Cloudflare
  - RCE
  - React2Shell
  - CVE-2025-55182
Severity: High
Description: Detects React2Shell (CVE-2025-55182) RCE attempts blocked by Cloudflare WAF
Runbook: |
  1. Query Cloudflare Firewall logs for all requests from the ClientIP in the 6 hours before and after the alert to identify attack patterns
  2. Check if the ClientIP is associated with known threat actors, scanning infrastructure, VPN services, or proxy networks
  3. Search for other React2Shell attempts from this IP or targeting the same ClientRequestHost in the past 7 days
Reference: https://blog.cloudflare.com/cloudflare-protection-against-cve-2025-55182-react2shell
SummaryAttributes:
  - Action
  - ClientCountry
  - ClientIP
  - ClientRequestUserAgent
  - ClientRequestHost