Apache CGI permission denied rule

[alex-front]

When running a scanner against an apache server I see lines like this in error_log:

"[Tue Feb 07 02:37:29.329569 2017] [cgi:error] [pid 9720] [client 10.101.1.50:35612] AH01215: (13)Permission denied: exec of '/usr/local/cpanel/cgi-sys/index.html' failed: /usr/local/cpanel/cgi-sys/index.html"

Many messages like this is a good indication of a malicious activity and should be detected by OSSEC but currently they are not:

[Tue Feb 07 02:37:29.329569 2017] [cgi:error] [pid 9720] [client 10.101.1.50:35612] AH01215: (13)Permission denied: exec of '/usr/local/cpanel/cgi-sys/index.html' failed: /usr/local/cpanel/cgi-sys/index.html

**Phase 1: Completed pre-decoding.
full event: '[Tue Feb 07 02:37:29.329569 2017] [cgi:error] [pid 9720] [client 10.101.1.50:35612] AH01215: (13)Permission denied: exec of '/usr/local/cpanel/cgi-sys/index.html' failed: /usr/local/cpanel/cgi-sys/index.html'
hostname: 'i360-dev-agent-el7-1'
program_name: '(null)'
log: '[Tue Feb 07 02:37:29.329569 2017] [cgi:error] [pid 9720] [client 10.101.1.50:35612] AH01215: (13)Permission denied: exec of '/usr/local/cpanel/cgi-sys/index.html' failed: /usr/local/cpanel/cgi-sys/index.html'

**Phase 2: Completed decoding.
decoder: 'apache-errorlog'
srcip: '10.101.1.50'
srcport: '35612'
id: 'AH01215'

**Phase 3: Completed filtering (rules).
Rule id: '30301'
Level: '0'
Description: 'Apache error messages grouped.'

[ddpbsd]

This is what I get:

**Phase 1: Completed pre-decoding.
       full event: '[Tue Feb 07 02:37:29.329569 2017] [cgi:error] [pid 9720] [client 10.101.1.50:35612] AH01215: (13)Permission denied: exec of '/usr/local/cpanel/cgi-sys/index.html' failed: /usr/local/cpanel/cgi-sys/index.html'
       hostname: 'ix'
       program_name: '(null)'
       log: '[Tue Feb 07 02:37:29.329569 2017] [cgi:error] [pid 9720] [client 10.101.1.50:35612] AH01215: (13)Permission denied: exec of '/usr/local/cpanel/cgi-sys/index.html' failed: /usr/local/cpanel/cgi-sys/index.html'

**Phase 2: Completed decoding.
       decoder: 'apache-errorlog'
       srcip: '10.101.1.50'
       srcport: '35612'
       id: 'AH01215'

**Phase 3: Completed filtering (rules).
       Rule id: '30412'
       Level: '2'
       Description: 'Permission denied.'
**Alert to be generated.

I'll have to recheck on a vanilla install.

[ddpbsd]

Ok, see PR #1045