1name: crowdsecurity/generic-freemarker-ssti
2description: "Generic FreeMarker SSTI"
3rules:
4  - and:
5    - zones: 
6      - RAW_BODY
7      - ARGS
8      transform:
9      - lowercase
10      match:
11        type: contains
12        value: 'freemarker.template.utility.execute'
13
14labels:
15   type: exploit
16   service: http
17   confidence: 2
18   spoofable: 0
19   behavior: "http:exploit"
20   label: "FreeMarker - Server-Side Template Injection"
21   classification:
22     - attack.T1595
23     - attack.T1190