RondoDox Log4Shell JNDI Header Spray (CVE-2021-44228)

Ethan Andrews@eandrews

•updated Jun 25, 2026•0•0•7

Detects the RondoDox campaign's use of obfuscated JNDI payloads targeting the Log4Shell (CVE-2021-44228) vulnerability. The rule identifies attempts to spray malicious JNDI lookup strings like ${env:NaN:-j}ndi across multiple HTTP headers including Authorization, Bearer, Cookie, and others, specifically designed to bypass web application firewall (WAF) filters.