Emerging Threatmediumtest

Potential CVE-2021-27905 Exploitation Attempt

Detects exploitation attempt of the CVE-2021-27905 which affects all Apache Solr versions prior to and including 8.8.1.

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

@gott_cyberCreated Sun Dec 11Updated Fri Mar 240bbcd74b-0596-41a4-94a0-4e88a76ffdb32021

Emerging Threat

Active Threat

Developed to detect an active or emerging threat. Prioritize investigation of any alerts and correlate with threat intelligence.

Log Source

Web Server Log

CategoryWeb Server Log← raw: webserver

HTTP access logs from web servers capturing request paths, methods, and status codes.

Detection Logic

detection:
    selection_request1:
        cs-uri-query|contains|all:
            - '/solr/'
            - '/debug/dump?'
            - 'param=ContentStream'
        sc-status: 200
    selection_request2:
        cs-method: 'GET'
        cs-uri-query|contains|all:
            - '/solr/'
            - 'command=fetchindex'
            - 'masterUrl='
        sc-status: 200
    condition: 1 of selection_*