Floci API Gateway VTL RCE — Java Process Spawning Shell or Marker File Creation
Detects instances where a Java-based application (specifically associated with 'floci' or API Gateway components) spawns suspicious child processes such as shell interpreters (sh, bash, powershell, cmd.exe). This pattern is often indicative of post-exploitation activity following a remote code execution (RCE) attempt against a template engine or web-facing gateway. It also identifies specific file paths related to documented 'floci' POCs and RCE payloads.
Cortex XDR
