Emerging Threathightest

Log4j RCE CVE-2021-44228 in Fields

Detects exploitation attempt against log4j RCE vulnerability reported as CVE-2021-44228 in different header fields found in web server logs (Log4Shell)

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch

Florian Roth (Nextron Systems)Created Fri Dec 10Updated Mon Jan 029be472ed-893c-4ec0-94da-312d2765f6542021

Emerging Threat

Active Threat

Developed to detect an active or emerging threat. Prioritize investigation of any alerts and correlate with threat intelligence.

Log Source

Web Server Log

CategoryWeb Server Log← raw: webserver

HTTP access logs from web servers capturing request paths, methods, and status codes.

Detection Logic

detection:
    selection1:
        cs-user-agent|contains:
            - '${jndi:ldap:/'
            - '${jndi:rmi:/'
            - '${jndi:ldaps:/'
            - '${jndi:dns:/'
            - '/$%7bjndi:'
            - '%24%7bjndi:'
            - '$%7Bjndi:'
            - '%2524%257Bjndi'
            - '%2F%252524%25257Bjndi%3A'
            - '${jndi:${lower:'
            - '${::-j}${'
            - '${jndi:nis'
            - '${jndi:nds'
            - '${jndi:corba'
            - '${jndi:iiop'
            - 'Reference Class Name: foo'
            - '${${env:BARFOO:-j}'
            - '${::-l}${::-d}${::-a}${::-p}'
            - '${base64:JHtqbmRp'
            - '${${env:ENV_NAME:-j}ndi${env:ENV_NAME:-:}$'
            - '${${lower:j}ndi:'
            - '${${upper:j}ndi:'
            - '${${::-j}${::-n}${::-d}${::-i}:'
    # selection2:
        # user-agent|contains:
            # - '${jndi:ldap:/'
            # - '${jndi:rmi:/'
            # - '${jndi:ldaps:/'
            # - '${jndi:dns:/'
            # - '/$%7bjndi:'
            # - '%24%7bjndi:'
            # - '$%7Bjndi:'
            # - '%2524%257Bjndi'
            # - '%2F%252524%25257Bjndi%3A'
            # - '${jndi:${lower:'
            # - '${::-j}${'
            # - '${jndi:nis'
            # - '${jndi:nds'
            # - '${jndi:corba'
            # - '${jndi:iiop'
            # - 'Reference Class Name: foo'
            # - '${${env:BARFOO:-j}'
            # - '${::-l}${::-d}${::-a}${::-p}'
            # - '${base64:JHtqbmRp'
            # - '${${env:ENV_NAME:-j}ndi${env:ENV_NAME:-:}$'
            # - '${${lower:j}ndi:'
            # - '${${upper:j}ndi:'
            # - '${${::-j}${::-n}${::-d}${::-i}:'
    selection3:
        cs-uri-query|contains:
            - '${jndi:ldap:/'
            - '${jndi:rmi:/'
            - '${jndi:ldaps:/'
            - '${jndi:dns:/'
            - '/$%7bjndi:'
            - '%24%7bjndi:'
            - '$%7Bjndi:'
            - '%2524%257Bjndi'
            - '%2F%252524%25257Bjndi%3A'
            - '${jndi:${lower:'
            - '${::-j}${'
            - '${jndi:nis'
            - '${jndi:nds'
            - '${jndi:corba'
            - '${jndi:iiop'
            - 'Reference Class Name: foo'
            - '${${env:BARFOO:-j}'
            - '${::-l}${::-d}${::-a}${::-p}'
            - '${base64:JHtqbmRp'
            - '${${env:ENV_NAME:-j}ndi${env:ENV_NAME:-:}$'
            - '${${lower:j}ndi:'
            - '${${upper:j}ndi:'
            - '${${::-j}${::-n}${::-d}${::-i}:'
    selection4:
        cs-referer|contains:
            - '${jndi:ldap:/'
            - '${jndi:rmi:/'
            - '${jndi:ldaps:/'
            - '${jndi:dns:/'
            - '/$%7bjndi:'
            - '%24%7bjndi:'
            - '$%7Bjndi:'
            - '%2524%257Bjndi'
            - '%2F%252524%25257Bjndi%3A'
            - '${jndi:${lower:'
            - '${::-j}${'
            - '${jndi:nis'
            - '${jndi:nds'
            - '${jndi:corba'
            - '${jndi:iiop'
            - 'Reference Class Name: foo'
            - '${${env:BARFOO:-j}'
            - '${::-l}${::-d}${::-a}${::-p}'
            - '${base64:JHtqbmRp'
            - '${${env:ENV_NAME:-j}ndi${env:ENV_NAME:-:}$'
            - '${${lower:j}ndi:'
            - '${${upper:j}ndi:'
            - '${${::-j}${::-n}${::-d}${::-i}:'
    condition: 1 of selection*