InfraGuard

Detection rule: Remote Code Execution Probe

Shell, command-exec, deserialization and JNDI payloads.

CriticalWeb Attack PatternsNginx

What it detects

Shell, command-exec, deserialization and JNDI payloads.

Why it fires

Exploit attempts aiming at server takeover (RCE).

Worst case

Server takeover (RCE)

Track these versions on your own servers

InfraGuard collects installed software versions from every server and flags the ones with known vulnerabilities. Self-hosted — nothing leaves your network.

Weekly exploited-vulnerability digest

The KEV additions that matter for self-hosted servers, once a week. No other mail.