Webserver Detection: WebLogic JndiBindingHandle LDAP Probe (CVE-2021-2109)

title: "Webserver Detection: WebLogic JndiBindingHandle LDAP Probe (CVE-2021-2109)"
id: fa3c0e09-215c-4964-bb5b-f7836aefb9b6
status: test
description: This rule flags HTTP GET requests whose query string contains the WebLogic JndiBindingHandle class reference along with an LDAP URL targeting the AdminServer. Such patterns are indicative of a server-side injection attempt that can leverage JNDI to reach external resources. The detection relies on webserver telemetry capturing the HTTP method and the raw URI query content in the incoming request.
references:
  - https://twitter.com/pyn3rd/status/1351696768065409026
  - https://mp.weixin.qq.com/s/wX9TMXl1KVWwB_k6EZOklw
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2021/Exploits/CVE-2021-2109/web_cve_2021_2109_weblogic_rce_exploit.yml
author: Bhabesh Raj, Huntrule Team
date: 2021-01-20
modified: 2023-01-02
tags:
  - attack.t1190
  - attack.initial-access
  - cve.2021-2109
  - detection.emerging-threats
logsource:
  category: webserver
detection:
  selection:
    cs-method: GET
    cs-uri-query|contains|all:
      - com.bea.console.handles.JndiBindingHandle
      - ldap://
      - AdminServer
  condition: selection
falsepositives:
  - Unknown
level: critical
license: DRL-1.1
related:
  - id: 687f6504-7f44-4549-91fc-f07bab065821
    type: derived