StyleSmuggler implant reading Magento session data from local Redis
This rule detects a high volume of inbound network connection attempts to the default Redis port (6379) originating from local loopback or local host addresses, excluding known legitimate Redis and web server processes. This activity is indicative of potential unauthorized access attempts or exploitation of local Redis instances.
Microsoft Sentinel (KQL)
