def detect_exploit_patterns(http_entries):
    findings = []

    for entry in http_entries:
        # Handle legacy string format
        if isinstance(entry, str):
            payload = entry.lower()
            src = "unknown"
            dst = "unknown"

        # Handle structured HTTP objects (future-proof)
        elif isinstance(entry, dict):
            payload = entry.get("raw", "").lower()
            src = entry.get("src", "unknown")
            dst = entry.get("dst", "unknown")

        else:
            continue

        indicators = [
            "jndi:",
            "${",
            "ldap://",
            "rmi://",
            "/shell",
            "cmd=",
            "exec=",
            "classloader"
        ]

        if any(i in payload for i in indicators):
            findings.append({
                "behavior": "SUSPICIOUS_PAYLOAD_PATTERN",
                "src": src,
                "dst": dst,
                "payload_snippet": payload[:120]
            })

    return findings
