This rule detects Cassandra CQL statements that create a JavaScript user-defined function (UDF), a potential abuse vector when Cassandra is vulnerable or misconfigured to allow scripted UDFs. In vulnerable environments, an adversary can exploit the JavaScript UDF to escape the Nashorn sandbox and execute operating-system commands, including via CVE-2021-44521. The rule focuses on network traffic data (network_traffic.cassandra) and matches queries containing a CREATE FUNCTION statement with a JavaScript language specification, indicating a UDF creation attempt. It extracts and analyzes the UDF metadata (function name, keyspace, language, and body) for indicators of Java interoperability, reflection, process execution, class loading, file access, or network activity initiated from within the UDF. The detection is supported by correlating Cassandra configuration (enable_user_defined_functions, enable_scripted_user_defined_functions, enable_user_defined_functions_threads), Cassandra version, and related logs. This provides a proactive signal for potential remote code execution via UDFs and helps drive containment and remediation actions. The rule aligns with MITRE ATT&CK technique T1059 (Command and Scripting Interpreter) with subtechnique T1059.007 (JavaScript) under Execution. The setup guidance notes that visibility depends on a network packet capture integration and cleartext access to Cassandra queries; TLS-encrypted traffic may limit visibility, in which case auditing and endpoint telemetry become critical corroboration sources. The rule includes a triage narrative, false-positive considerations, and recommended response steps, including isolating affected nodes, disabling scripted UDFs, upgrading to patched Cassandra versions, removing unauthorized functions, rotating credentials, and reviewing access controls to prevent further abuse.