Redis Lua EVAL sandbox-escape reads /etc/passwd via redis-server

Ibrahim Saud@tektrix

•updated 23 days ago•0•0•2

This rule detects a suspicious sequence of events indicative of a Redis Lua sandbox escape. It monitors for a network connection to Redis (port 6379) followed shortly by the redis-server process reading the system's /etc/passwd file, which is a known indicator of an attempted arbitrary file read via the EVAL command.