Potential Redis Lua Use-After-Free RCE Attempt (CVE-2025-49844 / RediShell)

This rule detects exploitation attempts targeting CVE-2025-49844 (RediShell), a CVSS 10.0 use-after-free vulnerability in the Redis Lua interpreter. An authenticated attacker sends an EVAL command containing a Lua script that calls string.rep() to create memory pressure and collectgarbage( collect ) to force garbage collection, exploiting a use-after-free in the Lua parser to achieve remote code execution.

Searches indices from : now-9m ( Date Math format , see also Additional look-back time )

Maximum alerts per execution : 100

Rule license : Elastic License v2

Disclaimer : This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.

Investigating Potential Redis Lua Use-After-Free RCE Attempt (CVE-2025-49844 / RediShell)

CVE-2025-49844 is a use-after-free in the Redis Lua interpreter. An authenticated attacker sends an EVAL command whose Lua script calls string.rep() to create memory pressure, then collectgarbage('collect') to force GC, triggering the use-after-free to achieve RCE. This rule matches on the network_traffic.redis.query field populated by the network_traffic (Packetbeat) Redis protocol module.

Possible investigation steps

False positive analysis

Response and remediation

This rule requires the Elastic network_traffic integration (Packetbeat via Elastic Agent) with the Redis protocol module enabled. The rule matches on the network_traffic.redis.query field (keyword — human-readable command text) populated for every Redis transaction; the raw wire bytes are available in network_traffic.redis.request (text) if deeper inspection is needed.

Enabling the Redis module

In the Elastic Agent network_traffic integration policy: 1. Add or confirm Redis in the protocols list with enabled: true . 2. Set ports to include 6379 (or the custom port your Redis instances listen on). 3. Deploy the sensor on the Redis host, on a SPAN/mirror port, or on a gateway that receives Redis traffic.

TLS limitation — this rule only covers unencrypted Redis

Redis uses a plaintext protocol by default (port 6379, no TLS). Packetbeat can inspect the full request payload on unencrypted connections, which is the configuration used by the vast majority of internet-exposed instances (8,500+ vulnerable instances identified as of October 2025 were all unencrypted).

If TLS is configured for Redis ( tls-port , tls-cert-file , and tls-key-file in redis.conf), Packetbeat cannot inspect the payload without TLS decryption. For TLS-protected Redis deployments, supplement this rule with endpoint detection (process command-line arguments, system call monitoring) on the Redis host itself.

Framework : MITRE ATT&CK TM