Floci API Gateway VTL Template Injection RCE — floci-apigateway-vtl-rce-poc
Detects potential Velocity Template Language (VTL) injection attacks targeting API Gateway environments. The rule identifies suspicious payloads in HTTP request bodies or URLs that attempt to leverage Java-based classes (e.g., ProcessBuilder) for code execution. It also monitors for IAM scope bypass attempts, abnormal HTTP method/path combinations associated with API Gateway control-plane operations, and evidence of shell/system commands being spawned from API Gateway-related parent processes.
Splunk (SPL)
