huntrule

Webserver log detection of Log4j CVE-2021-44228 JNDI payloads in User-Agent, URI query, or Referer

Flags webserver requests with ${jndi:...} payloads in User-Agent, URI query, or Referer indicative of Log4Shell attempts.

FreeReviewedSigma · High · v5
Category
webserver
Author
Florian Roth (Nextron Systems) (SigmaHQ), DRL 1.1
Published
2021-12-10
Updated
2026-07-31
AnalysisDetection
title: Webserver log detection of Log4j CVE-2021-44228 JNDI payloads in User-Agent, URI query, or Referer
id: e820f75d-6a43-4713-a8e9-a6a23159e668
status: test
description: This rule flags web requests whose User-Agent, URI query string, or Referer fields contain patterns consistent with Log4Shell-style JNDI lookup payloads associated with CVE-2021-44228. Such strings can indicate an attacker attempting to trigger remote lookup behavior via vulnerable log processing. It relies on webserver log telemetry and searches for known obfuscation and JNDI indicator substrings in those specific HTTP fields.
references:
  - https://web.archive.org/web/20231230220738/https://www.lunasec.io/docs/blog/log4j-zero-day/
  - https://news.ycombinator.com/item?id=29504755
  - https://github.com/tangxiaofeng7/apache-log4j-poc
  - https://gist.github.com/Neo23x0/e4c8b03ff8cdf1fa63b7d15db6e3860b
  - https://github.com/YfryTchsGD/Log4jAttackSurface
  - https://twitter.com/shutingrz/status/1469255861394866177?s=21
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2021/Exploits/CVE-2021-44228/web_cve_2021_44228_log4j_fields.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2021-12-10
modified: 2023-01-02
tags:
  - attack.initial-access
  - attack.t1190
  - cve.2021-44228
  - detection.emerging-threats
logsource:
  category: webserver
detection:
  selection1:
    cs-user-agent|contains:
      - ${jndi:ldap:/
      - ${jndi:rmi:/
      - ${jndi:ldaps:/
      - ${jndi:dns:/
      - "/$%7bjndi:"
      - "%24%7bjndi:"
      - "$%7Bjndi:"
      - "%2524%257Bjndi"
      - "%2F%252524%25257Bjndi%3A"
      - "${jndi:${lower:"
      - ${::-j}${
      - ${jndi:nis
      - ${jndi:nds
      - ${jndi:corba
      - ${jndi:iiop
      - "Reference Class Name: foo"
      - ${${env:BARFOO:-j}
      - ${::-l}${::-d}${::-a}${::-p}
      - ${base64:JHtqbmRp
      - ${${env:ENV_NAME:-j}ndi${env:ENV_NAME:-:}$
      - "${${lower:j}ndi:"
      - "${${upper:j}ndi:"
      - "${${::-j}${::-n}${::-d}${::-i}:"
  selection3:
    cs-uri-query|contains:
      - ${jndi:ldap:/
      - ${jndi:rmi:/
      - ${jndi:ldaps:/
      - ${jndi:dns:/
      - "/$%7bjndi:"
      - "%24%7bjndi:"
      - "$%7Bjndi:"
      - "%2524%257Bjndi"
      - "%2F%252524%25257Bjndi%3A"
      - "${jndi:${lower:"
      - ${::-j}${
      - ${jndi:nis
      - ${jndi:nds
      - ${jndi:corba
      - ${jndi:iiop
      - "Reference Class Name: foo"
      - ${${env:BARFOO:-j}
      - ${::-l}${::-d}${::-a}${::-p}
      - ${base64:JHtqbmRp
      - ${${env:ENV_NAME:-j}ndi${env:ENV_NAME:-:}$
      - "${${lower:j}ndi:"
      - "${${upper:j}ndi:"
      - "${${::-j}${::-n}${::-d}${::-i}:"
  selection4:
    cs-referer|contains:
      - ${jndi:ldap:/
      - ${jndi:rmi:/
      - ${jndi:ldaps:/
      - ${jndi:dns:/
      - "/$%7bjndi:"
      - "%24%7bjndi:"
      - "$%7Bjndi:"
      - "%2524%257Bjndi"
      - "%2F%252524%25257Bjndi%3A"
      - "${jndi:${lower:"
      - ${::-j}${
      - ${jndi:nis
      - ${jndi:nds
      - ${jndi:corba
      - ${jndi:iiop
      - "Reference Class Name: foo"
      - ${${env:BARFOO:-j}
      - ${::-l}${::-d}${::-a}${::-p}
      - ${base64:JHtqbmRp
      - ${${env:ENV_NAME:-j}ndi${env:ENV_NAME:-:}$
      - "${${lower:j}ndi:"
      - "${${upper:j}ndi:"
      - "${${::-j}${::-n}${::-d}${::-i}:"
  condition: 1 of selection*
falsepositives:
  - Vulnerability scanning
level: high
license: DRL-1.1
related:
  - id: 9be472ed-893c-4ec0-94da-312d2765f654
    type: derived