rules:
- name: "exchange_owa"
path: "/owa"
signature: "Exchange OWA"
description: "Outlook Web Access (OWA)"
severity: "info"
- name: "exchange_ecp"
path: "/ecp"
signature: "Exchange Control Panel"
description: "Exchange Control Panel (ECP)"
severity: "medium"
- name: "exchange_autodiscover"
path: "/autodiscover"
signature: "Exchange Autodiscover"
description: "Exchange Autodiscover service"
severity: "medium"
- name: "exchange_ews"
path: "/EWS"
signature: "Exchange Web Services"
description: "Exchange Web Services (EWS)"
severity: "medium"
- name: "exchange_mapi"
path: "/mapi"
signature: "Exchange MAPI"
description: "Exchange MAPI endpoint"
severity: "medium"
- name: "exchange_oab"
path: "/OAB"
signature: "Exchange OAB"
description: "Exchange Offline Address Book"
severity: "medium"
- name: "sharepoint_sites"
path: "/sites"
signature: "SharePoint Sites"
description: "SharePoint sites collection"
severity: "info"
- name: "sharepoint_admin"
path: "/_admin"
signature: "SharePoint Admin"
description: "SharePoint administration"
severity: "high"
- name: "sharepoint_layouts"
path: "/_layouts"
signature: "SharePoint Layouts"
description: "SharePoint layouts directory"
severity: "medium"
- name: "sharepoint_vti_bin"
path: "/_vti_bin"
signature: "SharePoint VTI"
description: "SharePoint VTI bin directory"
severity: "medium"
- name: "sharepoint_private"
path: "/_private"
signature: "SharePoint Private"
description: "SharePoint private directory"
severity: "high"
- name: "sharepoint_api"
path: "/_api"
signature: "SharePoint API"
description: "SharePoint REST API"
severity: "medium"
- name: "iis_aspnet_client"
path: "/aspnet_client"
signature: "ASP.NET Client"
description: "ASP.NET client resources"
severity: "low"
- name: "iis_webdav"
path: "/webdav"
signature: "WebDAV"
description: "WebDAV directory"
severity: "medium"
- name: "iis_web_config"
path: "/web.config"
signature: "Web Config"
description: "Exposed IIS web.config file"
severity: "critical"
- name: "iis_web_service"
path: "/webservice"
signature: "Web Service"
description: "IIS web service"
severity: "medium"
- name: "iis_iisstart"
path: "/iisstart.htm"
signature: "IIS Start"
description: "Default IIS start page"
severity: "low"
- name: "iis_iishelp"
path: "/iishelp"
signature: "IIS Help"
description: "IIS help documentation"
severity: "low"
- name: "sql_server_adv_docs"
path: "/SQLServer/Databases/AdventureWorks"
signature: "SQL Server Sample DB"
description: "SQL Server AdventureWorks sample database"
severity: "high"
- name: "sql_server_reporting"
path: "/Reports"
signature: "SQL Reporting Services"
description: "SQL Server Reporting Services"
severity: "medium"
- name: "ssrs_web_service"
path: "/ReportServer"
signature: "Report Server"
description: "SQL Server Reporting Services web service"
severity: "medium"
- name: "ssms_portal"
path: "/SSMS"
signature: "SSMS"
description: "SQL Server Management Studio portal"
severity: "high"
- name: "sql_server_apis"
path: "/SQLAPI"
signature: "SQL API"
description: "SQL Server API endpoint"
severity: "high"
- name: "sql_server_analytics"
path: "/SQLAnalytics"
signature: "SQL Analytics"
description: "SQL Server Analytics platform"
severity: "medium"
- name: "azure_ad_login"
path: "/adfs"
signature: "ADFS"
description: "Active Directory Federation Services"
severity: "high"
- name: "azure_sso"
path: "/sso"
signature: "Azure SSO"
description: "Azure single sign-on"
severity: "medium"
- name: "microsoft_graph"
path: "/graph"
signature: "Microsoft Graph"
description: "Microsoft Graph API endpoint"
severity: "medium"
- name: "o365_admin"
path: "/admin"
signature: "Office 365 Admin"
description: "Office 365 admin portal"
severity: "high"
- name: "ms_teams_api"
path: "/teams/api"
signature: "Teams API"
description: "Microsoft Teams API"
severity: "medium"
- name: "onedrive_api"
path: "/onedrive/api"
signature: "OneDrive API"
description: "OneDrive API"
severity: "medium"
- name: "remote_desktop_web"
path: "/RDWeb"
signature: "Remote Desktop"
description: "Remote Desktop Web Access"
severity: "high"
- name: "remote_web_gateway"
path: "/gateway"
signature: "RD Gateway"
description: "Remote Desktop Gateway"
severity: "high"
- name: "windows_server_admin"
path: "/wac"
signature: "Windows Admin Center"
description: "Windows Admin Center"
severity: "high"
- name: "powershell_web"
path: "/PSWebAccess"
signature: "PowerShell Web"
description: "PowerShell Web Access"
severity: "critical"
- name: "windows_update_services"
path: "/WSUS"
signature: "WSUS"
description: "Windows Server Update Services"
severity: "medium"
- name: "windows_deployment"
path: "/WDS"
signature: "WDS"
description: "Windows Deployment Services"
severity: "medium"