✄𐘗
text code block:
✄𐘗network where http.request.method == "POST" and http.response.status_code != 200 and
(
    // Node.js child_process module
    (
        http.request.body.content like~ "*require('child_process')*" or
        http.request.body.content like~ "*require(\"child_process\")*" or
        http.request.body.content like~ "*child_process*" and http.request.body.content like~ "*.exec*"
    ) or
    // Node.js synchronous execution methods
    (
        http.request.body.content like~ "*.execSync(*" or
        http.request.body.content like~ "*.spawnSync(*" or
        http.request.body.content like~ "*.execFileSync(*"
    ) or
    // Node.js file system operations - suspicious in RSC context
    (
        http.request.body.content like~ "*require('fs')*" or
        http.request.body.content like~ "*require(\"fs\")*" or
        http.request.body.content like~ "*.readFileSync(*" or
        http.request.body.content like~ "*.writeFileSync(*" or
        http.request.body.content like~ "*.unlinkSync(*"
    ) or
    // Process and module access patterns used in exploitation
    (
        http.request.body.content like~ "*process.mainModule*" or
        http.request.body.content like~ "*process.binding*" or
        http.request.body.content like~ "*process.dlopen*"
    ) or
    // JavaScript code execution primitives
    (
        http.request.body.content like~ "*eval(*" and http.request.body.content like~ "*require*" or
        http.request.body.content like~ "*Function(*" and http.request.body.content like~ "*return*"
    ) or
    // Generic prototype pollution indicators
    (
        http.request.body.content like~ "*prototype*" and http.request.body.content like~ "*constructor*"
    )
)