Shellshock Bash CGI Exploitation Attempt

Darshan Thummar@Mighty

•updated Jun 10, 2026•0•0•3

This rule detects attempts to exploit the Shellshock Bash vulnerability via CGI. It specifically looks for HTTP requests containing the string "() {" in the header, which is characteristic of the Shellshock exploit payload used to inject arbitrary commands.