ATT&CK T1190 - Log4Shell Exploitation Attempt

Darshan Thummar@Mighty

•updated Jun 10, 2026•0•0•4

This rule detects attempts to exploit the Log4Shell vulnerability (CVE-2021-44228) by looking for the specific JNDI injection string "${jndi:" within HTTP URI requests. This pattern is commonly used by attackers to trigger remote code execution in vulnerable Log4j versions.