Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
47 detections
Filters
Last updated
All Time
Detection languages
38
4
4
1
Contributors
38
4
4
1
Categories
18
10
9
7
5
Platforms
18
11
9
4
2
Products / Services
10,661
9,758
6,692
4,418
3,749
MITRE Techniques
13
13
12
12
11
CVEs
6
1
1
1
1
IDS Classtypes
4
IDS Protocols
4
The following analytic identifies URL requests associated with CVE-2022-22965 (Spring4Shell) exploitation attempts, specifically targeting webshell access on a remote webserver. It detects HTTP GET requests with URLs containing ".jsp?cmd=" or "j&cmd=" patterns. This activity is significant as it indicates potential webshell deployment, which can lead to unauthorized remote command execution. If confirmed malicious, attackers could gain control over the webserver, execute arbitrary commands, and potentially escalate privileges, leading to severe data breaches and system compromise.
Detects suspicious exceptions within the Spring framework that could indicate attempts to exploit vulnerabilities. These exceptions often arise during web application attacks such as CSRF attempts, cookie theft, or other forms of unauthorized access or manipulation.
Detects potential Spring Expression Language (SpEL) Injection exploitation attempts, which can lead to Remote Code Execution (RCE). The rule specifically looks for the 'org.springframework.expression.ExpressionException' keyword in application error logs, indicating that an attempt to evaluate a malicious expression might have occurred or failed.
Detects suspicious Spring framework exceptions that could indicate exploitation attempts
Detects potential SpEL Injection exploitation, which may lead to RCE.
Page 3 of 3