Weblog Detection of Apache Spark Shell Command Injection Payloads (?doAs=`)
Alerts on web requests containing "?doAs=`" that may indicate Spark shell command injection attempts.
- Category
- webserver
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2022-07-19
- Updated
- 2026-07-31
ATT&CK techniques
Initial AccessRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags web requests recorded in weblogs whose query string contains the specific payload fragment "?doAs=`", indicative of an Apache Spark shell command injection attempt. Attackers may use this kind of injection to execute unintended commands through vulnerable Spark request handling. The detection relies on webserver request telemetry that captures the full URI query as a string in the weblogs.
Reporting behind it
- github.comhttps://github.com/W01fh4cker/cve-2022-33891/blob/fd973b56e78bca8822caa3a2e3cf1b5aff5d0950/cve_2022_33891_poc.py
- sumsec.mehttps://sumsec.me/2022/CVE-2022-33891%20Apache%20Spark%20shell%20command%20injection.html
- github.comhttps://github.com/apache/spark/pull/36315/files
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2022/Exploits/CVE-2022-33891/web_cve_2022_33891_spark_shell_command_injection.yml
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Weblog Detection of Apache Spark Shell Command Injection Payloads (?doAs=`)
id: d01b63b4-5f54-4e05-be94-ab9935899a5f
status: test
description: This rule flags web requests recorded in weblogs whose query string contains the specific payload fragment "?doAs=`", indicative of an Apache Spark shell command injection attempt. Attackers may use this kind of injection to execute unintended commands through vulnerable Spark request handling. The detection relies on webserver request telemetry that captures the full URI query as a string in the weblogs.
references:
- https://github.com/W01fh4cker/cve-2022-33891/blob/fd973b56e78bca8822caa3a2e3cf1b5aff5d0950/cve_2022_33891_poc.py
- https://sumsec.me/2022/CVE-2022-33891%20Apache%20Spark%20shell%20command%20injection.html
- https://github.com/apache/spark/pull/36315/files
- https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2022/Exploits/CVE-2022-33891/web_cve_2022_33891_spark_shell_command_injection.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-07-19
modified: 2023-01-02
tags:
- attack.initial-access
- attack.t1190
- cve.2022-33891
- detection.emerging-threats
logsource:
category: webserver
detection:
selection:
cs-uri-query|contains: ?doAs=`
condition: selection
falsepositives:
- Web vulnerability scanners
level: high
license: DRL-1.1
related:
- id: 1a9a04fd-02d1-465c-abad-d733fd409f9c
type: derived