Oracle WebLogic Exploit CVE-2021-2109

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•1•0•23

Detects exploitation attempts against the Oracle WebLogic server vulnerability CVE-2021-2109. The rule specifically looks for GET requests containing 'com.bea.console.handles.JndiBindingHandle', 'ldap://', and 'AdminServer' in the URI query, which are indicators of an attempted JNDI injection via LDAP.