Velvet Ant Nginx Config Modified to Proxy FastCGI Requests for Air-Gap Traversal

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•1

This rule detects modifications to Nginx configuration files (nginx.conf, or files within conf.d, sites-enabled, or sites-available directories) by processes other than authorized system management tools (e.g., nginx, apt, ansible). It further correlates these file modifications with subsequent Nginx configuration reloads, which is a common behavior when an adversary attempts to apply malicious configuration changes to a web server.