Log4j RCE CVE-2021-44228 Exploitation Attempt in Web Fields

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•1•0•38

Detects exploitation attempts against the Log4j RCE vulnerability (CVE-2021-44228), commonly known as Log4Shell. The rule specifically looks for various JNDI injection patterns within web server log fields such as User-Agent, URI query, and Referer headers, which are common vectors for this vulnerability.