SvrGuard analyzes your host's access and auth logs, identifies the attacking source, and writes its IP into the kernel firewall within minutes — then shares it with your other hosts. Every attack class below was actually attacked — with industry-standard penetration-testing tools, or with requests built for that rule: detection fires, and the source really lands in the firewall.
Mapped to OWASP Top 10, CWE and MITRE ATT&CK. The "representative CVEs / techniques" are examples of the attack class each rule covers, shown to illustrate scope.
| Attack class | Standards | Representative CVEs / techniques | Rules | Detect | Block |
|---|---|---|---|---|---|
| Web scanning / directory brute-force | MITRE T1595 Active Scanning, T1083 Directory Discovery; CWE-200 | Nikto / Gobuster / ZAP-style bursts of 404/403 path probing |
R1R8 | ✓ | ✓ |
| SQL injection | OWASP A03:2021 Injection; CWE-89; T1190 | sqlmap signatures, UNION SELECT, ' OR 1=1 |
R5 | ✓ | ✓ |
| Secret & credential exposure probing | OWASP A05 Misconfiguration / A01; CWE-538/540; T1552 | .env, .git/config, .aws/credentials, id_rsa, wp-config.php |
R10 | ✓ | ✓ |
| Known product exploits | OWASP A06 Vulnerable Components; MITRE T1190 | Exchange ProxyShell (CVE-2021-34473/34523/31207), ProxyLogon (CVE-2021-26855), SAP RECON (CVE-2020-6287), DVR (CVE-2018-9995) | R20 | ✓ | ✓ |
| Sensitive-path / exploit probing | OWASP A06, A03; MITRE T1190 | Path traversal (CWE-22), PHPUnit RCE (CVE-2017-9841), PHP-CGI (CVE-2012-1823), Spring Cloud Gateway (CVE-2022-22947), Apache Solr (CVE-2019-17558) | R2 | ✓ | ✓ |
| SSH brute-force | OWASP A07 Auth Failures; CWE-307; T1110 Brute Force | Hydra serial password attempts (auth log) | R15 | ✓ | ✓ |
| Cross-site coordinated probing | MITRE T1595 distributed reconnaissance | One source probing the same nonexistent path across multiple sites | R16 | ✓ | ✓ |
| Open-proxy abuse | CWE-441 Unintended Proxy; OWASP A10 SSRF; T1090 | absolute-form requests, CONNECT tunneling |
R18 | ✓ | ✓ |
| SSH-port protocol anomaly | MITRE T1046 Network Service Discovery | Non-SSH packets sent to the SSH port (port scan / protocol anomaly) | R19 | ✓ | ✓ |
| Non-HTTP protocol to a web port | MITRE T1046 Service Discovery; protocol anomaly | TLS ClientHello to the HTTP port (the web server must log such connections, as nginx does) | R17 | ✓ | ✓ |
Also covered: high-rate requests / app-layer flood, login brute-force, VPN / admin auth-endpoint brute-force, admin & database back-office probing, and server access-denied (rules present, triggered by host conditions).
On a rule hit, the source IP goes straight into the kernel firewall (nftables / ipset / iptables) — not just a log line, not just an alert.
Every day we compile and approve confirmed attacking sources and deliver the updated threat-address database to your hosts — you block what others already got hit by, before it reaches you.
Failed enforcement and attacks send you a notice; degraded mode shows a warning on the console. You never lose protection silently.
Most rules judge behavior: scanning, brute-force attempts, protocol anomalies. When a vulnerability gets a new CVE number, an attack that behaves the same is still caught.
As new attack techniques appear, we keep adding and strengthening detection rules and deliver them to your hosts via updates — your defense only gets stronger.
The "representative CVEs / techniques" are examples of the attack class each rule covers, shown to illustrate scope — not a claim of per-CVE patching. SvrGuard is a behavior-based detection-and-blocking host agent: whichever vulnerability an attacker targets, once the behavior falls within a rule, the source is cut off. Detection and blocking are free, forever.
For real-world situations see use cases; for why this product exists, see why we built it.
