Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
6 detections
Filters
Last updated
All Time
Detection languages
4
1
1
Contributors
3
3
Categories
6
5
3
1
Platforms
3
3
1
1
Products / Services
3
2
2
1
1
MITRE Techniques
4
4
3
3
3
CVEs
71
71
64
58
49
IDS Classtypes
1
This rule detects exploitation attempts against Oracle WebLogic servers by identifying HTTP requests that target known WebLogic administrative or internal endpoints and simultaneously contain indicators of command execution payloads within the URL. Specifically, it looks for URLs containing '/console/', '/wls-wsat/', '/bea_wls_internal/', or '/_async/' combined with keywords like 'cmd=', 'bash', 'powershell', 'wget', 'curl', 'base64', 'IEX', or 'Runtime.getRuntime'. The rule also requires the source IP to be different from the target IP, indicating an external attacker. This pattern is typical of Remote Code Execution (RCE) exploitation attempts, including those targeting vulnerabilities like CVE-2026-21962.
Detects suspicious WebLogic HTTP requests with command execution indicators, specifically targeting known WebLogic endpoints and looking for patterns indicative of Remote Code Execution (RCE) payloads. The rule also correlates this activity with external IP addresses.
Detects exploitation attempts against Oracle WebLogic via suspicious HTTP requests and command execution patterns. The rule identifies WebLogic-specific endpoints combined with RCE payload indicators such as cmd, bash, powershell, wget, curl, or encoded payloads within the URI query.
Detects attempts to exploit CVE-2026-21962, a header spoofing vulnerability in Oracle WebLogic Server. The rule identifies suspicious requests where 'wl-proxy-client-ip' or 'x-forwarded-for' headers contain localhost/loopback addresses or command injection keywords, combined with URI paths related to 'weblogic' or 'proxy'.
Detects exploitation attempts of CVE-2026-21962 (Critical - CVSS 10.0) in Oracle WebLogic Server Proxy Plug-in. The vulnerability allows unauthenticated attackers to bypass access controls via path traversal (patterns like /_proxy/ or /wl_proxy/ + weblogic/..; + ProxyServlet) and header spoofing (WL-Proxy-Client-IP pointing to localhost/127.0.0.1). Successful exploitation can lead to unauthorized access, data modification or full compromise of the backend WebLogic Server.
This rule detects attempts to exploit CVE-2026-21962, a vulnerability in Oracle WebLogic Server. It specifically looks for requests to Application Gateway or Frontdoor logs that contain 'weblogic' in the URI, along with path traversal indicators ('..;', '%2e%2e') or specific proxy paths ('/_proxy/', '/wl_proxy/'), and keywords like 'proxyservlet' or 'bea_wls_internal'. These patterns are indicative of attempts to bypass security controls and access internal resources within a WebLogic environment.