Rejetto HFS HTTP request RCE exploit pattern via null-byte search and script/command payloads

Detects Rejetto HFS HTTP requests with a crafted search parameter and command/script execution indicators.

FreeReviewedSigma · High · v5

Category: webserver
Author: Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
Published: 2022-07-19
Updated: 2026-07-31

ATT&CK techniques

Initial Access → Persistence

Recon
Resource Dev
Initial Access
- T1190Exploit Public-Facing Application
Execution
Persistence
- T1505.003Web Shell
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags webserver requests to Rejetto HTTP File Server that include a specific null-byte search query and command or scripting strings in the URL parameters. Such patterns are commonly used to trigger remote code execution attempts by forcing the application to process attacker-controlled file-save and interpreter/command content. It relies on HTTP telemetry that exposes the requested URI query string for substring matching of the exploit indicators.

Reporting behind it

Related detections9 linkedT1190 — drag to rearrange

Malicious Web Shell Written to SharePoint LAYOUTS Directory by Worker Process (via file_event)

Malicious Command Shell Spawned by SQL Server via Process Creation (via process_creation)

Possible GoAnywhere MFT Exploitation via Tomcat Spawning Discovery Commands

Suspicious Command Shell Spawned by MSSQL Server Process Indicating Webshell

Malicious MOVEit Transfer Exploitation via X-siLock HTTP Headers (via webserver)

Malicious IIS w3wp Worker Spawning Command Interpreter via SharePoint Web Shell

Suspicious Single-Character Named Executable Launched by Web Server Process (via process_creation)

Malicious MOVEit human2.aspx Web Shell Dropped in wwwroot (via file_event)

Malicious IIS Worker Process Spawning PowerShell via Gladinet CentreStack Exploit

Rejetto HFS HTTP request RCE exploit pattern via null-byte search and script/command payloads

Pivot detection · T1190 · 9 related

Changelog

v5
Candidate ingested via manual entry.2026-07-31
v4
Candidate ingested via manual entry.2026-07-31
v3
Candidate ingested via manual entry.2026-07-31
v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

rejetto-hfs-exploit-attempt-http-search-query-probing-for-command-or-script-exec-a133193c

title: Rejetto HFS HTTP request RCE exploit pattern via null-byte search and script/command payloads
id: a0b2bca4-1bd1-483c-bb1c-3927b12d2d7e
status: test
description: This rule flags webserver requests to Rejetto HTTP File Server that include a specific null-byte search query and command or scripting strings in the URL parameters. Such patterns are commonly used to trigger remote code execution attempts by forcing the application to process attacker-controlled file-save and interpreter/command content. It relies on HTTP telemetry that exposes the requested URI query string for substring matching of the exploit indicators.
references:
  - https://vk9-sec.com/hfs-code-execution-cve-2014-6287/
  - https://www.exploit-db.com/exploits/39161
  - https://github.com/Twigonometry/Cybersecurity-Notes/blob/c875b0f52df7d2c7a870e75e1f0c2679d417931d/Writeups/Hack%20the%20Box/Boxes/Optimum/10%20-%20Website.md
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2014/Exploits/CVE-2014-6287/web_cve_2014_6287_hfs_rce.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-07-19
modified: 2023-01-02
tags:
  - attack.persistence
  - attack.initial-access
  - attack.t1190
  - attack.t1505.003
  - cve.2014-6287
  - detection.emerging-threats
logsource:
  category: webserver
detection:
  selection_search:
    cs-uri-query|contains: ?search=%00{.
  selection_payload:
    cs-uri-query|contains:
      - save|
      - powershell
      - cmd.exe
      - cmd /c
      - cmd /r
      - cmd /k
      - cscript
      - wscript
      - python
      - C:\Users\Public\
      - "%comspec%"
  condition: all of selection_*
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: a133193c-2daa-4a29-8022-018695fcf0ae
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL