Log4Shell CVE-2021-44228 JNDI Injection via HTTP Headers

Ankit Mehta@Secvyn

•updated Jun 30, 2026•0•0•7

Detects attempts to exploit the Log4Shell vulnerability (CVE-2021-44228) by monitoring HTTP headers for JNDI lookup strings. The rule inspects traffic for malicious patterns like '${jndi:ldap://', '${jndi:rmi://', or '${jndi:dns://', which are used to trigger remote code execution in vulnerable Java applications.