Web server access to WebLogic keystore JavaScript webshell URLs
Flags web requests attempting to access JavaScript content within a WebLogic keystore path.
FreeReviewedSigma · Critical · v5
- Category
- webserver
- Author
- Florian Roth (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2018-07-22
- Updated
- 2026-07-31
ATT&CK techniques
Initial Access → PersistenceRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule matches HTTP requests whose query string targets a JavaScript file under a WebLogic config keystore path. Attackers who exploit WebLogic may drop webshell files into this location for persistence and remote command execution via direct web access. The detection relies on web server request telemetry, specifically the recorded request URI query string.
Reporting behind it
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
webserver-access-to-webshell-in-weblogic-keystore-folder-37e8369b
title: Web server access to WebLogic keystore JavaScript webshell URLs
id: 6188175d-7bfd-4cd2-a9d4-5c8e6ff1831d
status: test
description: This rule matches HTTP requests whose query string targets a JavaScript file under a WebLogic config keystore path. Attackers who exploit WebLogic may drop webshell files into this location for persistence and remote command execution via direct web access. The detection relies on web server request telemetry, specifically the recorded request URI query string.
references:
- https://twitter.com/pyn3rd/status/1020620932967223296
- https://github.com/LandGrey/CVE-2018-2894
- https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2018/Exploits/CVE-2018-2894/web_cve_2018_2894_weblogic_exploit.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2018-07-22
modified: 2023-01-02
tags:
- attack.t1190
- attack.initial-access
- attack.persistence
- attack.t1505.003
- cve.2018-2894
- detection.emerging-threats
logsource:
category: webserver
detection:
selection:
cs-uri-query: "*/config/keystore/*.js*"
condition: selection
falsepositives:
- Unknown
level: critical
license: DRL-1.1
related:
- id: 37e8369b-43bb-4bf8-83b6-6dd43bda2000
type: derived