Update rules_building_block/initial_access_react_server_components_rce_attempt.toml

terrancedejesus · Samirbous · web-flow · commit 8df9f49dd350 · 2025-12-04T18:52:35.000-05:00
Co-authored-by: Samirbous &lt;64742097+Samirbous@users.noreply.github.com&gt;
diff --git a/rules_building_block/initial_access_react_server_components_rce_attempt.toml b/rules_building_block/initial_access_react_server_components_rce_attempt.toml
@@ -70,7 +70,7 @@ timestamp_override = "event.ingested"
 type = "eql"
 
 query = '''
-network where event.category == "network" and http.request.method == "POST" and
+network where http.request.method == "POST" and
   (
     http.request.body.content like~ "*$ACTION_REF*" or
     http.request.body.content like~ "*$ACTION_*:*"

Original file line number	Diff line number	Diff line change
`@@ -70,7 +70,7 @@ timestamp_override = "event.ingested"`
`70`	`70`	`type = "eql"`
`71`	`71`
`72`	`72`	`query = '''`
`73`		`-network where event.category == "network" and http.request.method == "POST" and`
	`73`	`+network where http.request.method == "POST" and`
`74`	`74`	`(`
`75`	`75`	`http.request.body.content like~ "$ACTION_REF" or`
`76`	`76`	`http.request.body.content like~ "$ACTION_:*"`