Velvet Ant Nginx FastCGI Proxy-Chain Pivoting to Isolated Internal Hosts

Ibrahim Saud@tektrix

•updated Jun 30, 2026•1•0•2

This rule detects when an Nginx web server proxies HTTP POST requests to FastCGI backends located on internal network subnets (RFC1918) or local unix sockets. Such behavior often indicates exploitation attempts targeting internal FastCGI interfaces, which should typically not be reachable directly from the internet-facing web server.