ZD EXPLOIT Template or expression language injection marker

Ali AlEnezi@site

•updated Sep 15, 2026•0•0•0

This rule detects common patterns associated with Expression Language (EL) injection attacks in HTTP traffic. These patterns typically attempt to invoke Java reflection, runtime execution, or process creation through vulnerable applications utilizing templating engines or expression evaluators (e.g., OGNL, Spring Expression Language). Attackers use these to achieve remote code execution (RCE).