huntrule

Webserver detection of Log4j RCE (CVE-2021-44228) JNDI injection patterns

Detects webserver traffic containing Log4Shell-style JNDI injection payload strings, excluding Nessus scan artifacts.

FreeReviewedSigma · High · v5
Category
webserver
Author
Florian Roth (Nextron Systems) (SigmaHQ), DRL 1.1
Published
2021-12-10
Updated
2026-07-31
AnalysisDetection

ATT&CK techniques

Initial Access

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule matches webserver requests containing common Log4j JNDI lookup and obfuscation strings associated with the CVE-2021-44228 exploitation attempt. Attackers use these payload patterns to trigger outbound lookups (for example via LDAP/RMI/DNS/others) that can lead to remote code execution. The detection relies on HTTP/webserver telemetry and keyword matches against the request content, while excluding events containing a specific Nessus-related substring.

Reporting behind it

Related detections9 linkedT1190 — drag to rearrange
Suspicious PraisonAI Vulnerability Scanner User Agent via Webserver
Malicious LiteLLM Authentication SQL Injection via Web Request (via webserver)
Possible Marimo Unauthenticated Terminal WebSocket Access via Web Request (via webserver)
Possible React2Shell Next.js Prototype Pollution Exploitation via Web Request (via webserver)
Malicious Marimo Notebook Credential File Access via Shell (via process_creation)
Malicious Ingress-nginx Configuration Injection via Kubernetes Audit (via kubernetes)
Malicious SharePoint ToolShell Post-Exploitation via Encoded PowerShell (via process_creation)
Malicious Web Shell Written to SharePoint LAYOUTS Directory by Worker Process (via file_event)
Malicious MS-SQL Server Spawning Command Shell via Mallox
Webserver detection of Log4j RCE (CVE-2021-44228) JNDI injection patterns
Pivot detection · T1190 · 9 related

Changelog

v5
  1. v5
    Candidate ingested via manual entry.2026-07-31
  2. v4
    Candidate ingested via manual entry.2026-07-31
  3. v3
    Candidate ingested via manual entry.2026-07-31
  4. v2
    Candidate ingested via manual entry.2026-07-31
  5. v1
    No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.