Potential JNDI Injection Exploitation In JVM Based Application

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•22

This rule detects potential JNDI (Java Naming and Directory Interface) injection exploitation attempts within JVM-based applications. It specifically looks for keywords related to LDAP lookups ('com.sun.jndi.ldap.') and the Log4j JndiManager ('org.apache.logging.log4j.core.net.JndiManager') in application error logs. Such patterns are commonly associated with vulnerabilities like Log4Shell, where attackers inject malicious JNDI lookup strings to achieve remote code execution.