Malicious Middleware Component Deployed on App Server

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•2

This rule detects the deployment of a potentially malicious middleware component on an application server. It specifically looks for HTTP POST requests to port 8080 with a URI containing 'deploy' (case-insensitive) and a data size greater than 10000 bytes. This pattern is indicative of a large payload being sent to deploy an application or component, which could be malicious in nature.