Server-Side Template Injection Attempt

Darshan Thummar@Mighty

•updated Jun 10, 2026•0•0•1

This rule detects attempts at Server-Side Template Injection (SSTI) by looking for specific patterns in HTTP URI requests. It triggers an alert if the URI contains sequences like `{{.*}}` or `${.*}`, which are commonly used in various template engines to inject and execute code.