removed constructor requirement

Author: terrancedejesus

rules/network/initial_access_react_server_components_rce_attempt.toml

@@ -76,16 +76,16 @@ network where http.request.method == "POST" and
     // Successful CVE-2025-55182 RCE - command output in digest
     (
         http.response.status_code in (500, 303) and
-        http.response.body.content like "*E{\"digest\"*" and
+        http.response.body.content like~ "*E{\"digest\"*" and
         http.request.body.content regex~ """.*\$[0-9]+:[a-zA-Z_0-9]+:[a-zA-Z_0-9]+.*"""
-
     ) or
-    // Prototype pollution patterns specific to RSC Flight exploitation
-    ( http.request.body.content regex~ """.*\$[0-9]+:[a-zA-Z_0-9]+:[a-zA-Z_0-9]+.*""" and (
+    // Prototype pollution attempts in RSC Flight data (never legitimate)
+    (
+        http.request.body.content regex~ """.*\$[0-9]+:[a-zA-Z_0-9]+:[a-zA-Z_0-9]+.*""" and
         (
             http.request.body.content like~ "*__proto__*" or
             http.request.body.content like~ "*prototype*"
-        ) and http.request.body.content like~ "*constructor*")
+        )
     )
 )
 '''