Data Source: Network Packet Capture

Potential Redis CONFIG SET SSH Authorized Key Injection

Jun 17, 2026 · Domain: Network Use Case: Threat Detection Tactic: Persistence Tactic: Initial Access Data Source: Network Packet Capture Resources: Investigation Guide ·

Share on:

This rule detects attempts to abuse Redis CONFIG SET commands to inject SSH authorized keys on Linux hosts. Attackers targeting unauthenticated Redis instances issue CONFIG SET dir to an SSH directory such as /root/.ssh, set the filename to authorized_keys via CONFIG SET dbfilename, write an attacker-controlled public key via SET, and call BGSAVE to flush it to disk, establishing persistent SSH access as root.

Potential Redis Lua Use-After-Free RCE Attempt (CVE-2025-49844 / RediShell)

Jun 15, 2026 · Domain: Network Use Case: Threat Detection Use Case: Vulnerability Tactic: Initial Access Tactic: Execution Data Source: Network Packet Capture Resources: Investigation Guide ·

Share on:

This rule detects exploitation attempts targeting CVE-2025-49844 (RediShell), a CVSS 10.0 use-after-free vulnerability in the Redis Lua interpreter. An authenticated attacker sends an EVAL command containing a Lua script that calls string.rep() to create memory pressure and collectgarbage('collect') to force garbage collection, exploiting a use-after-free in the Lua parser to achieve remote code execution.

Potential Redis CONFIG SET Cron Directory Persistence (RedisRaider)

Jun 15, 2026 · Domain: Network Use Case: Threat Detection Tactic: Persistence Tactic: Impact Data Source: Network Packet Capture Resources: Investigation Guide ·

Share on:

This rule detects attempts to abuse Redis CONFIG SET commands to redirect the database save directory to a cron directory on Linux hosts. Attackers issue CONFIG SET dir to a cron path such as /etc/cron.d or /var/spool/cron, set a filename via CONFIG SET dbfilename, write a cron payload via SET, and then call BGSAVE to flush it to disk, establishing persistence for execution of an XMRig cryptominer.

Potential cPanel WHM CRLF Authentication Bypass (CVE-2026-41940)

Jun 8, 2026 · Domain: Network Domain: Application Domain: Web Use Case: Threat Detection Use Case: Vulnerability Tactic: Initial Access Data Source: Network Packet Capture Data Source: Network Traffic Data Source: Zeek Resources: Investigation Guide ·

Share on:

Identifies the network signature of CVE-2026-41940, a pre-auth root-level authentication bypass in cPanel and WebHost Manager (WHM) caused by a CRLF injection in the session writer. The exploit-inherent shape on the wire is a GET / request to a cPanel/WHM admin port (typically TCP/2087, 2086, 2083, 2082, 2095, 2096) carrying an Authorization: Basic header whose base64-decoded value contains CRLF-injected session fields, which causes cpsrvd to respond with a 3xx redirect whose Location header leaks a /cpsessNNNNNNNNNN token granting the attacker a privileged session. This is the network-layer equivalent of the cPanel access_log artifact identified by Unfold and watchTowr as the first bulletproof detection for this CVE: a GET / recorded with auth_method=b (HTTP Basic). Legitimate access to GET / on a WHM admin port returns 200 with the login screen and never includes HTTP Basic credentials, so this combination is not produced by normal use.

Cloud Instance Metadata Credential Path HTTP Request

May 27, 2026 · Domain: Cloud Domain: Network OS: Linux OS: Windows OS: macOS Use Case: Threat Detection Tactic: Credential Access Data Source: Network Packet Capture Resources: Investigation Guide ·

Share on:

Detects HTTP GET requests to the link-local instance metadata service (169.254.169.254) for cloud credential or token paths on AWS, GCP, or Azure. Adversaries and vulnerable workloads use scripts, shells, or application runtimes to read IAM role credentials or OAuth tokens from the metadata API. Requires the Network Packet Capture integration with HTTP decoding on ports 80 and 443 and process enrichment enabled so "process.*" fields are present.

React2Shell (CVE-2025-55182) Exploitation Attempt

Dec 5, 2025 · Domain: Network Domain: Application Domain: Web Use Case: Threat Detection Use Case: Vulnerability Tactic: Initial Access Tactic: Execution Data Source: Network Packet Capture Resources: Investigation Guide ·

Share on:

This rule detects exploitation attempts targeting CVE-2025-55182, a critical remote code execution vulnerability in React Server Components (RSC) Flight protocol. The vulnerability allows attackers to execute arbitrary code on the server by sending specially crafted deserialization payloads that exploit prototype chain traversal to access the Function constructor. This rule focuses on high-fidelity indicators of active exploitation including successful command execution responses and prototype pollution attack patterns.