Possible SpringShell Exploitation Attempt (CVE-2022-22965)

'This hunting query looks in Azure Web Application Firewall data to find possible SpringShell Exploitation Attempt (CVE-2022-22965). The Spring Framework is one of the most widely used lightweight open-source framework for Java. To exploit the vulnerability attackers can send a specially crafted query to a web server running the Spring Core framework to change the target of logging facility and create a new malicious JSP file in a location accessible by http requests. Attackers then make requests to the malicious backdoor to run system commands. Reference: https://www.microsoft.com/security/blog/2022/04/04/springshell-rce-vulnerability-guidance-for-protecting-against-and-detecting-cve-2022-22965/'