huntrule

Webserver log detection of Log4j CVE-2021-44228 JNDI payloads in User-Agent, URI query, or Referer

Flags webserver requests with ${jndi:...} payloads in User-Agent, URI query, or Referer indicative of Log4Shell attempts.

FreeReviewedSigma · High · v5
Category
webserver
Author
Florian Roth (Nextron Systems) (SigmaHQ), DRL 1.1
Published
2021-12-10
Updated
2026-07-31
AnalysisDetection

ATT&CK techniques

Initial Access

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule flags web requests whose User-Agent, URI query string, or Referer fields contain patterns consistent with Log4Shell-style JNDI lookup payloads associated with CVE-2021-44228. Such strings can indicate an attacker attempting to trigger remote lookup behavior via vulnerable log processing. It relies on webserver log telemetry and searches for known obfuscation and JNDI indicator substrings in those specific HTTP fields.

Reporting behind it

Related detections9 linkedT1190 — drag to rearrange
Malicious LiteLLM Authentication SQL Injection via Web Request (via webserver)
Possible Marimo Unauthenticated Terminal WebSocket Access via Web Request (via webserver)
Possible React2Shell Next.js Prototype Pollution Exploitation via Web Request (via webserver)
Malicious Marimo Notebook Credential File Access via Shell (via process_creation)
Malicious Ingress-nginx Configuration Injection via Kubernetes Audit (via kubernetes)
Malicious SharePoint ToolShell Post-Exploitation via Encoded PowerShell (via process_creation)
Malicious Web Shell Written to SharePoint LAYOUTS Directory by Worker Process (via file_event)
Malicious MS-SQL Server Spawning Command Shell via Mallox
Malicious ActiveMQ CVE-2023-46604 Payload Download via curl or wget
Webserver log detection of Log4j CVE-2021-44228 JNDI payloads in User-Agent, URI query, or Referer
Pivot detection · T1190 · 9 related

Changelog

v5
  1. v5
    Candidate ingested via manual entry.2026-07-31
  2. v4
    Candidate ingested via manual entry.2026-07-31
  3. v3
    Candidate ingested via manual entry.2026-07-31
  4. v2
    Candidate ingested via manual entry.2026-07-31
  5. v1
    No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.