Floci API Gateway VTL Server-Side Template Injection RCE (floci-apigateway-vtl-rce-poc)

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•1

This rule monitors network traffic for suspicious patterns indicating exploitation of LocalStack environments. It detects three primary malicious activities: Velocity Template Language (VTL) injection targeting reflection methods (e.g., ProcessBuilder) for RCE; unauthorized manipulation of API Gateway resources (e.g., creating or modifying deployments) accompanied by IAM scope bypass techniques; and direct execution of RCE-style API triggers against known LocalStack port 4566.