Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2 detections
Filters
Last updated
All Time
Detection languages
1
1
Contributors
1
1
Categories
1
1
1
Platforms
1
Products / Services
1
MITRE Techniques
1
1
1
1
CVEs
71
71
64
58
49
CVE-2026-42945, dubbed "NGINX Rift," is a critical (CVSS 9.2) heap buffer overflow vulnerability in the ngx_http_rewrite_module of NGINX Open Source, NGINX Plus, and related products. It is triggered when a specific rewrite configuration pattern—using an unnamed PCRE capture (e.g., $1) with a replacement string containing a question mark (?)—is combined with a subsequent rewrite, if, or set directive. Exploitation can lead to reliable worker process crashes (Denial of Service) and, under certain conditions such as disabled ASLR, unauthenticated Remote Code Execution (RCE)
Detects an NGINX worker process spawning a shell or interpreter process, the post-exploitation primitive for CVE-2026-42945 (NGINX Rift). The exploit chain corrupts the ngx_pool_t cleanup handler and triggers system() with attacker-controlled shell commands, causing the nginx worker to fork /bin/sh with the -c flag. Since system() always invokes /bin/sh -c, the highest-fidelity match is nginx → /bin/sh -c <command>. Generalizes to catch arbitrary interpreter spawning (bash, python, perl, ruby, netcat variants, socat) which would result from any future post-exploitation pivot. Scoped to Linux because the exploit relies on the fork-based multi-worker architecture (Linux/BSD only). Windows nginx is not affected by the heap feng shui exploitation primitive.
