JVM Application Error Logs Indicating JNDI Injection Payloads

title: JVM Application Error Logs Indicating JNDI Injection Payloads
id: 47ae9e5d-8372-4500-87bf-08baf4e1e32f
status: test
description: This rule flags JVM application error log entries that contain indicators associated with JNDI-based injection attempts, including LDAP JNDI strings and Log4j JndiManager references. Attackers commonly use JNDI payloads to trigger remote lookups or code execution paths when a vulnerable application logs attacker-controlled data. The detection relies on collected application error logs (LOG_LEVEL=ERROR and above) and keyword matches for the specified JNDI-related strings.
references:
  - https://www.wix.engineering/post/threat-and-vulnerability-hunting-with-application-server-error-logs
  - https://secariolabs.com/research/analysing-and-reproducing-poc-for-log4j-2-15-0
  - https://github.com/SigmaHQ/sigma/blob/master/rules/application/jvm/java_jndi_injection_exploitation_attempt.yml
author: Moti Harmats, Huntrule Team
date: 2023-02-11
tags:
  - attack.initial-access
  - attack.t1190
logsource:
  category: application
  product: jvm
  definition: "Requirements: application error logs must be collected (with LOG_LEVEL=ERROR and above)"
detection:
  keywords:
    - com.sun.jndi.ldap.
    - org.apache.logging.log4j.core.net.JndiManager
  condition: keywords
falsepositives:
  - Application bugs
level: high
license: DRL-1.1
related:
  - id: bb0e9cec-d4da-46f5-997f-22efc59f3dca
    type: derived