[ModSecurity] Parser wont parse

[LaurenceJJones]

2024/02/08 00:56:35 [error] 2120350#2120350: *527836 [client 10.10.10.10] ModSecurity: Access denied with code 403 (phase 1). Matched "Operator `Rx' with parameter `check-if-host-header-legit' against variable `REQUEST_HEADERS:Host' (Value: `0.0.0.0' ) [file "/etc/nginx/modsecurity/custom-rules/56000-MALICIOUS-BOTS-BLOCKING.conf"] [line "79"] [id "56008"] [rev ""] [msg "HTTP Scanner detected"] [data ""] [severity "42"] [ver ""] [maturity "0"] [accuracy "0"] [hostname "0.0.0.0"] [uri "/Electron/download/windows/\Program Files\3CX Phone System\Data\DB\base\16384\16393"] [unique_id "170731419583.493262"] [ref "v138,7v138,7"], client: 10.10.10.10, server: _, request: "GET /Electron/download/windows/\Program%20Files\3CX%20Phone%20System\Data\DB\base\16384\16393 HTTP/1.0", host: "0.0.0.0"

Current ModSecurity parser will not parse the above details line, due to \ in URI path. A fix can be change URIPATHPARAM to DATA

\"%{WORD:verb} %{DATA:request} HTTP/%{NUMBER:http_version}\"