Floci API Gateway VTL Injection RCE via SigV4 IAM Scope Bypass

Ibrahim Saud@tektrix

•updated Jun 29, 2026•0•0•6

This rule detects potential Remote Code Execution (RCE) attempts leveraging Velocity Template Language (VTL) injection vulnerabilities within AWS API Gateway. It monitors logs for specific indicators, including references to 'ProcessBuilder', malicious template artifacts, and exploitation patterns associated with the 'floci-apigateway-vtl-rce-poc' exploit.