Log4Shell CVE-2021-44228 JNDI Injection with Callback to 62.171.185.97

Ibrahim Saud@tektrix

•updated Jun 25, 2026•1•0•7

This rule detects potential Log4Shell (CVE-2021-44228) exploitation attempts by identifying JNDI injection patterns in web request headers, process command lines, and syslog messages. It further identifies suspicious outbound network callbacks to known malicious infrastructure associated with these exploitation attempts.