Velvet Ant Nginx/FastCGI config chaining for air-gapped network pivot

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•3

This rule detects potentially suspicious modifications to Nginx configuration files or the usage of FastCGI directives such as fcgiwrap, fastcgi_pass, and proxy_pass. It specifically monitors for actions related to configuration changes (write, modify, create) or the establishment of backend communication via FastCGI parameters, which may indicate an attempt to gain remote code execution or persistence on a web server.