Log4Shell CVE-2021-44228 JNDI Lookup Exploitation Attempt

Ankit Mehta@Secvyn

•updated Jun 30, 2026•0•0•4

Detects inbound HTTP requests containing JNDI lookup strings commonly used to exploit the Log4Shell vulnerability (CVE-2021-44228). The rule specifically monitors for JNDI lookups over ldap, rmi, or dns protocols within HTTP traffic, which can lead to remote code execution.