Spring4Shell RCE Exploitation Attempt

Darshan Thummar@Mighty

•updated Jun 10, 2026•0•0•5

This rule detects exploitation attempts targeting the Spring4Shell vulnerability (CVE-2022-22965). It specifically looks for HTTP requests containing the string "class.module.classLoader" in the URI, which is a known indicator of this RCE exploitation attempt.