Which ModSecurity version are you using? ARGS
variable only includes QUERY_STRING
+ POST_PAYLOAD
in version 1.X. If you're running version 2.X, with your above rule, testing with a request as below:
http://domain.com/a?b=km0ae9gr6m
you'll see something like this in the audit_log
:
[modsecurity] [client x.x.x.x] [domain domain.com] [302] [/20120813/20120813-1226/20120813-122624-70QXqH8AAAEA
AEucDbkAAAAA] [file "/etc/httpd/modsecurity.d/modsecurity_crs_10_config.conf"] [line "305"] [msg "Access Denied"] Access denied with code 403 (phase 2). Pattern match "km0ae9gr6m" at ARGS:b.
In ModSecurity 2.x, ARGS
expands to individual variables. So, try this:
SecRule REQUEST_URI|ARGS|REQUEST_BODY "km0ae9gr6m" "log,deny,msg:'Access Denied'"