Web server access to WebLogic keystore JavaScript webshell URLs

Flags web requests attempting to access JavaScript content within a WebLogic keystore path.

FreeReviewedSigma · Critical · v5

Category: webserver
Author: Florian Roth (Nextron Systems) (SigmaHQ), DRL 1.1
Published: 2018-07-22
Updated: 2026-07-31

ATT&CK techniques

Initial Access → Persistence

Recon
Resource Dev
Initial Access
- T1190Exploit Public-Facing Application
Execution
Persistence
- T1505.003Web Shell
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule matches HTTP requests whose query string targets a JavaScript file under a WebLogic config keystore path. Attackers who exploit WebLogic may drop webshell files into this location for persistence and remote command execution via direct web access. The detection relies on web server request telemetry, specifically the recorded request URI query string.

Reporting behind it

Related detections9 linkedT1190 — drag to rearrange

Malicious Web Shell Written to SharePoint LAYOUTS Directory by Worker Process (via file_event)

Malicious Command Shell Spawned by SQL Server via Process Creation (via process_creation)

Possible GoAnywhere MFT Exploitation via Tomcat Spawning Discovery Commands

Suspicious Command Shell Spawned by MSSQL Server Process Indicating Webshell

Malicious MOVEit Transfer Exploitation via X-siLock HTTP Headers (via webserver)

Malicious IIS w3wp Worker Spawning Command Interpreter via SharePoint Web Shell

Suspicious Single-Character Named Executable Launched by Web Server Process (via process_creation)

Malicious MOVEit human2.aspx Web Shell Dropped in wwwroot (via file_event)

Malicious IIS Worker Process Spawning PowerShell via Gladinet CentreStack Exploit

Web server access to WebLogic keystore JavaScript webshell URLs

Pivot detection · T1190 · 9 related

Changelog

v5
Candidate ingested via manual entry.2026-07-31
v4
Candidate ingested via manual entry.2026-07-31
v3
Candidate ingested via manual entry.2026-07-31
v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

webserver-access-to-webshell-in-weblogic-keystore-folder-37e8369b

title: Web server access to WebLogic keystore JavaScript webshell URLs
id: 6188175d-7bfd-4cd2-a9d4-5c8e6ff1831d
status: test
description: This rule matches HTTP requests whose query string targets a JavaScript file under a WebLogic config keystore path. Attackers who exploit WebLogic may drop webshell files into this location for persistence and remote command execution via direct web access. The detection relies on web server request telemetry, specifically the recorded request URI query string.
references:
  - https://twitter.com/pyn3rd/status/1020620932967223296
  - https://github.com/LandGrey/CVE-2018-2894
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2018/Exploits/CVE-2018-2894/web_cve_2018_2894_weblogic_exploit.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2018-07-22
modified: 2023-01-02
tags:
  - attack.t1190
  - attack.initial-access
  - attack.persistence
  - attack.t1505.003
  - cve.2018-2894
  - detection.emerging-threats
logsource:
  category: webserver
detection:
  selection:
    cs-uri-query: "*/config/keystore/*.js*"
  condition: selection
falsepositives:
  - Unknown
level: critical
license: DRL-1.1
related:
  - id: 37e8369b-43bb-4bf8-83b6-6dd43bda2000
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL