Rejetto HTTP File Server RCE via CVE-2014-6287

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•0•20

Detects attempts to exploit a Rejetto HTTP File Server (HFS) via CVE-2014-6287. The rule looks for specific patterns in the URI query that indicate an attempt to inject commands or save files, which are characteristic of this vulnerability. The presence of '?search=%00{.' combined with keywords like 'powershell', 'cmd.exe', 'cscript', 'wscript', 'python', or paths like 'C:\Users\Public\' suggests an exploitation attempt.