Skip to main content
SEBI Annexure-A Item 1 · Download Resource

Virtual patching playbook.

Eight common vulnerability classes. For each: the attacker capability, why a virtual patch fits here, and concrete WAF / ModSecurity / network-ACL / detection-alert recipes. Buy yourself the days you need to deploy the real fix — without leaving an open door.

AI-driven attackers compress the window between disclosure and exploitation. Virtual patching is no longer "nice to have" — it's the only honest answer to "what do we do until the vendor patch lands?"

See AI-Resilient VAPT
Item 1
Annexure-A Source
8
Vulnerability Classes
Open
No Gate · Use Freely
WAF · ACL · IPS
Mechanism Coverage

Virtual Patching Playbook

Enter your work email to access the complete virtual-patching reference — WAF rules, ModSecurity, network ACLs, and detection alerts for 8 vulnerability classes.

By downloading, you agree to receive relevant communications. We respect your privacy.

How to read this playbook

Architecture-specific patterns, not universal recipes. The WAF rules, ACL patterns, and detection signatures below are starting points for common stacks. Always test in your specific reverse-proxy + WAF + application context before deploying to production.

  • Pick the vulnerability class that matches your finding (or the closest analogue).
  • Read "Why virtual patch here" first — it tells you whether virtual patching is the right interim control or whether you need to take the system offline.
  • Apply the mechanism appropriate to your stack — WAF, ModSecurity, network ACL — typically more than one in combination.
  • Wire the detection alert immediately. A virtual patch you can't measure isn't a control — it's a hope.
  • Track retirement. Every virtual patch goes in a register with an owner, an installed date, and an explicit retirement criterion. Stale virtual patches accumulate into legacy infrastructure that no one understands.

SQL Injection

Attacker: Authentication bypass, data exfiltration, RCE in some DBMS

Why virtual patch here: Vendor patches for ORM-level SQLi often require regression testing across business logic. Virtual patching at the WAF layer buys days to weeks.

WAF rule

AWS WAF managed rule "AWSManagedRulesSQLiRuleSet"; or custom regex on parameters in known-vulnerable endpoints flagging UNION/SELECT/--/;DROP patterns

ModSecurity

OWASP CRS rules in `/etc/modsecurity-crs/rules/REQUEST-942-APPLICATION-ATTACK-SQLI.conf` — enable paranoia level 2 for the affected vhost

Network ACL / egress

Limited utility — SQLi rides on port 443. Use it only to lock down DB-management interfaces from non-admin networks.

Detection alert

SIEM alert on WAF block-action rate spike on the vulnerable endpoint; correlate with downstream DB query patterns

Retirement criteria

Remove rule when (a) vendor patch deployed + verified via re-test, AND (b) 7 days of zero block-action telemetry

Cross-Site Scripting (XSS)

Attacker: Session hijacking, credential theft, drive-by attacks against authenticated users

Why virtual patch here: Stored-XSS fixes need data-cleanup migrations; reflected-XSS fixes need framework upgrades. Both take time.

WAF rule

WAF rule blocking `<script`, `javascript:`, `onerror=`, `onload=` patterns in user-input parameters; allow-list for known-rich-text fields

ModSecurity

OWASP CRS rules `941xxx` — adjust paranoia + apply Content-Security-Policy header injection at reverse proxy

Network ACL / egress

N/A

Detection alert

Browser CSP violation reports if you have a `report-uri` endpoint; SIEM alert on WAF XSS blocks

Retirement criteria

Remove when (a) framework patched / sanitisation applied, (b) post-exploit retest clean, (c) CSP report-uri shows zero violations for 7 days

Command Injection / RCE

Attacker: Full system compromise, lateral movement, persistence

Why virtual patch here: P0 risk — virtual patching is interim only; aim for vendor patch within 24–72h. Do not run with virtual patching > 1 week here.

WAF rule

Block shell metacharacters (`;`, `|`, `&`, `>`) in parameters known to feed system calls; aggressive paranoia

ModSecurity

CRS `932xxx` (RCE) rules at paranoia 3 or 4 for the affected endpoint

Network ACL / egress

Egress firewall: deny outbound from compromised host class to known C2 infrastructure / pastebin / DNS-over-HTTPS providers

Detection alert

EDR + SIEM correlation: process spawn from web-server identity (`www-data`, `IIS APPPOOL\*`) executing `cmd.exe`/`/bin/sh`/`bash`

Retirement criteria

Remove only when patch + retest clean. P0 risks should not run virtual-only beyond 1 week.

Authentication Bypass

Attacker: Account takeover, privilege escalation, financial fraud

Why virtual patch here: Auth bypass fixes often touch the entire identity stack. Interim controls layer additional auth.

WAF rule

Custom rule: enforce additional header (e.g. `X-Auth-Step-Up`) on the affected endpoint, set by an IDP step-up flow

ModSecurity

Rate-limit access to the affected endpoint per IP + per session to limit brute-force amplification

Network ACL / egress

Restrict admin/management endpoints to corporate VPN ranges only

Detection alert

SIEM rule: failed-auth followed by successful-auth from same IP within short window; new-user-agent for known accounts

Retirement criteria

Remove when patch deployed + auth-flow regression test clean across all user roles

IDOR / Authorization Bypass

Attacker: Cross-tenant data access, data exfiltration, fraud

Why virtual patch here: IDOR fixes require business-logic changes. Virtual patch through API gateway / WAF can mediate access.

WAF rule

API gateway rule: validate ID parameter against authenticated user's session-bound ID list (where feasible)

ModSecurity

Custom rule blocking direct numeric ID lookups for affected endpoints; force routing through indirect-reference endpoints

Network ACL / egress

N/A

Detection alert

SIEM rule: anomalous high-cardinality ID enumeration from single session; rate-limit triggers on affected endpoint

Retirement criteria

Remove when authorisation-check added at controller + service layer + verified via authz-focused retest

Server-Side Request Forgery (SSRF)

Attacker: Cloud metadata exfiltration (AWS IMDS), internal-network reconnaissance, internal-service exploitation

Why virtual patch here: SSRF fixes need URL-validation library upgrades. Egress controls layer interim defence.

WAF rule

Block requests where parameter contains `169.254.169.254` (AWS IMDS), `metadata.google.internal`, RFC1918 ranges

ModSecurity

Custom rule + IMDSv2 enforcement at the AWS account level (not virtual patching strictly, but companion control)

Network ACL / egress

Egress firewall: deny outbound from web-server tier to RFC1918 + cloud-metadata IP except whitelisted internal services

Detection alert

CloudTrail / VPC Flow Log alert on requests to 169.254.169.254 from non-IMDS-expected sources

Retirement criteria

Remove when URL-validation upgraded + SSRF-specific retest clean. IMDSv2 enforcement should remain permanently regardless.

XML External Entity (XXE) / XML Bomb

Attacker: Local file read, SSRF, DoS

Why virtual patch here: Disabling DTDs at parser level is the right fix; virtual patching screens malicious XML at the perimeter.

WAF rule

Block XML payloads containing `<!ENTITY`, `<!DOCTYPE` references to external DTDs, billion-laughs patterns

ModSecurity

OWASP CRS rules `949xxx` (anomaly-scoring) catch most XXE — increase paranoia for affected endpoints

Network ACL / egress

N/A

Detection alert

SIEM alert on WAF XXE blocks; correlate with downstream file-read telemetry

Retirement criteria

Remove when XML parsers configured to disable external entities + retest clean

Deserialisation

Attacker: RCE — extremely high impact

Why virtual patch here: Deserialisation fixes often need complete library rewrites. P0 — virtual patch is bandaid only.

WAF rule

Block known deserialisation gadget signatures in request bodies (Java: `rO0AB`; .NET: `AAEAAAD`; PHP: `O:` patterns)

ModSecurity

Custom rule blocking serialised payload signatures on affected endpoints

Network ACL / egress

Egress controls: prevent compromised tier from reaching outbound C2

Detection alert

EDR alert on serialiser-process spawning shell

Retirement criteria

Remove only after patch / library upgrade. Deserialisation should not run virtual-only beyond 5 days.

Security Brigade · CERT-In empanelled since 2008 · This playbook is a starting point. Every virtual patch must be tested against your specific application + reverse proxy + WAF stack before deployment to production. Source advisory: SEBI Circular HO/13/19/12(1)2026-ITD-1_CIMGI/10873/2026 (5 May 2026), Annexure-A item 1.

Need help validating a virtual patch?

We can re-test the affected endpoint with the virtual patch in place + provide a defensible report for your IT-committee evidence pack. Fixed-scope micro-engagement; days, not weeks.

Request a Virtual-Patch Validation