Rejetto HFS HTTP request RCE exploit pattern via null-byte search and script/command payloads
Detects Rejetto HFS HTTP requests with a crafted search parameter and command/script execution indicators.
- Category
- webserver
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2022-07-19
- Updated
- 2026-07-31
ATT&CK techniques
Initial Access → PersistenceRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags webserver requests to Rejetto HTTP File Server that include a specific null-byte search query and command or scripting strings in the URL parameters. Such patterns are commonly used to trigger remote code execution attempts by forcing the application to process attacker-controlled file-save and interpreter/command content. It relies on HTTP telemetry that exposes the requested URI query string for substring matching of the exploit indicators.
Reporting behind it
- vk9-sec.comhttps://vk9-sec.com/hfs-code-execution-cve-2014-6287/
- exploit-db.comhttps://www.exploit-db.com/exploits/39161
- github.comhttps://github.com/Twigonometry/Cybersecurity-Notes/blob/c875b0f52df7d2c7a870e75e1f0c2679d417931d/Writeups/Hack%20the%20Box/Boxes/Optimum/10%20-%20Website.md
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2014/Exploits/CVE-2014-6287/web_cve_2014_6287_hfs_rce.yml
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Rejetto HFS HTTP request RCE exploit pattern via null-byte search and script/command payloads
id: a0b2bca4-1bd1-483c-bb1c-3927b12d2d7e
status: test
description: This rule flags webserver requests to Rejetto HTTP File Server that include a specific null-byte search query and command or scripting strings in the URL parameters. Such patterns are commonly used to trigger remote code execution attempts by forcing the application to process attacker-controlled file-save and interpreter/command content. It relies on HTTP telemetry that exposes the requested URI query string for substring matching of the exploit indicators.
references:
- https://vk9-sec.com/hfs-code-execution-cve-2014-6287/
- https://www.exploit-db.com/exploits/39161
- https://github.com/Twigonometry/Cybersecurity-Notes/blob/c875b0f52df7d2c7a870e75e1f0c2679d417931d/Writeups/Hack%20the%20Box/Boxes/Optimum/10%20-%20Website.md
- https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2014/Exploits/CVE-2014-6287/web_cve_2014_6287_hfs_rce.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-07-19
modified: 2023-01-02
tags:
- attack.persistence
- attack.initial-access
- attack.t1190
- attack.t1505.003
- cve.2014-6287
- detection.emerging-threats
logsource:
category: webserver
detection:
selection_search:
cs-uri-query|contains: ?search=%00{.
selection_payload:
cs-uri-query|contains:
- save|
- powershell
- cmd.exe
- cmd /c
- cmd /r
- cmd /k
- cscript
- wscript
- python
- C:\Users\Public\
- "%comspec%"
condition: all of selection_*
falsepositives:
- Unknown
level: high
license: DRL-1.1
related:
- id: a133193c-2daa-4a29-8022-018695fcf0ae
type: derived