Webserver detection for JNDI-Exploit-Kit exploit and memshell URL path patterns

Flags webserver requests whose URL paths match known JNDI-Exploit-Kit exploit, deserialization, and memshell pattern strings.

FreeUnreviewedSigmahighv1

webserver-detection-for-jndi-exploit-kit-exploit-and-memshell-url-path-patterns-412d55bc

title: Webserver detection for JNDI-Exploit-Kit exploit and memshell URL path patterns
id: 97820797-75af-4402-8184-26c59514e2b0
status: test
description: This rule matches webserver requests containing specific URL path substrings associated with the JNDI-Exploit-Kit exploitation chain, including Basic and bypass variants as well as common deserialization and memshell routes. Such patterns matter because they indicate likely attempts to trigger remote code execution and deploy server-side payloads through crafted JNDI/deserialization behavior. It relies on webserver telemetry where the request URL or path is available for keyword substring matching.
references:
  - https://github.com/pimps/JNDI-Exploit-Kit
  - https://web.archive.org/web/20231015205935/https://githubmemory.com/repo/FunctFan/JNDIExploit
  - https://github.com/SigmaHQ/sigma/blob/master/rules/web/webserver_generic/web_jndi_exploit.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2021-12-12
modified: 2022-12-25
tags:
  - attack.initial-access
  - attack.t1190
logsource:
  category: webserver
detection:
  keywords:
    - /Basic/Command/Base64/
    - /Basic/ReverseShell/
    - /Basic/TomcatMemshell
    - /Basic/JettyMemshell
    - /Basic/WeblogicMemshell
    - /Basic/JBossMemshell
    - /Basic/WebsphereMemshell
    - /Basic/SpringMemshell
    - /Deserialization/URLDNS/
    - /Deserialization/CommonsCollections1/Dnslog/
    - /Deserialization/CommonsCollections2/Command/Base64/
    - /Deserialization/CommonsBeanutils1/ReverseShell/
    - /Deserialization/Jre8u20/TomcatMemshell
    - /TomcatBypass/Dnslog/
    - /TomcatBypass/Command/
    - /TomcatBypass/ReverseShell/
    - /TomcatBypass/TomcatMemshell
    - /TomcatBypass/SpringMemshell
    - /GroovyBypass/Command/
    - /WebsphereBypass/Upload/
  condition: keywords
falsepositives:
  - Legitimate apps the use these paths
level: high
license: DRL-1.1
related:
  - id: 412d55bc-7737-4d25-9542-5b396867ce55
    type: derived

What it detects

This rule matches webserver requests containing specific URL path substrings associated with the JNDI-Exploit-Kit exploitation chain, including Basic and bypass variants as well as common deserialization and memshell routes. Such patterns matter because they indicate likely attempts to trigger remote code execution and deploy server-side payloads through crafted JNDI/deserialization behavior. It relies on webserver telemetry where the request URL or path is available for keyword substring matching.

Known false positives

Legitimate apps the use these paths

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.