Possible SpringShell Exploitation Attempt (CVE-2022-22965)

Description

'This hunting query looks in Azure Web Application Firewall data to find possible SpringShell Exploitation Attempt (CVE-2022-22965). The Spring Framework is one of the most widely used lightweight open-source framework for Java. To exploit the vulnerability attackers can
send a specially crafted query to a web server running the Spring Core framework to change the target of logging facility and create a new malicious JSP file in a location accessible by http requests. Attackers then make requests to the malicious backdoor to run system commands. Reference: https://www.microsoft.com/security/blog/2022/04/04/springshell-rce-vulnerability-guidance-for-protecting-against-and-detecting-cve-2022-22965/'

Query · kql

let spring4shellstring = dynamic(["class.module.classLoader.resources.context.parent.pipeline.first.pattern="]);
AzureDiagnostics
| where Category in ("FrontdoorWebApplicationFirewallLog", "FrontdoorAccessLog", "ApplicationGatewayFirewallLog", "ApplicationGatewayAccessLog")
| extend originalRequestUriWithArgs_s = column_ifexists("originalRequestUriWithArgs_s", ""), 
   userAgent_s = column_ifexists("userAgent_s", ""), 
   clientIP_s = column_ifexists("clientIP_s", ""),  
   clientPort_d = column_ifexists("originalRequestUriWithArgs_s", ""),
   host_s = column_ifexists("host_s", ""),
   requestUri_s = column_ifexists("requestUri_s", ""),
   httpStatus_d = column_ifexists("httpStatus_d",""),
   listenerName_s = column_ifexists("listenerName_s", ""),
   httpMethod_s = column_ifexists("httpMethod_s", "")
| where httpMethod_s =~ 'POST'
| where originalRequestUriWithArgs_s has_any (spring4shellstring) or requestUri_s has_any (spring4shellstring)
| summarize Total = count() by originalRequestUriWithArgs_s, userAgent_s, clientIP_s,clientPort_d, TimeGenerated, host_s, requestUri_s, httpStatus_d,listenerName_s, httpMethod_s, Category
| extend IPCustomEntity = clientIP_s, timestamp = TimeGenerated, UrlCustomEntity = requestUri_s, HostCustomEntity = host_s
Raw source Possible SpringShell Exploitation Attempt (CVE-2022-22965) · KQL
Esc
Published by Azure/Azure-Sentinel ↗, licensed under MIT ↗. Reproduced here unmodified. 
id: 1bb4a007-7d1d-4506-ada9-222604f54ec6
name: Possible SpringShell Exploitation Attempt (CVE-2022-22965)
description: |
  'This hunting query looks in Azure Web Application Firewall data to find possible SpringShell Exploitation Attempt (CVE-2022-22965).
   The Spring Framework is one of the most widely used lightweight open-source framework for Java. To exploit the vulnerability attackers can  
   send a specially crafted query to a web server running the Spring Core framework to change the target of logging facility and create a new 
   malicious JSP file in a location accessible by http requests. Attackers then make requests to the malicious backdoor to run system commands.
   Reference: https://www.microsoft.com/security/blog/2022/04/04/springshell-rce-vulnerability-guidance-for-protecting-against-and-detecting-cve-2022-22965/'
requiredDataConnectors:
  - connectorId: WAF
    dataTypes:
      - AzureDiagnostics
tactics:
  - InitialAccess
relevantTechniques:
  - T1190
tags:
  - CVE-2022-22965
  - SpringShell 
  - Spring4Shell
query: |
 let spring4shellstring = dynamic(["class.module.classLoader.resources.context.parent.pipeline.first.pattern="]);
 AzureDiagnostics
 | where Category in ("FrontdoorWebApplicationFirewallLog", "FrontdoorAccessLog", "ApplicationGatewayFirewallLog", "ApplicationGatewayAccessLog")
 | extend originalRequestUriWithArgs_s = column_ifexists("originalRequestUriWithArgs_s", ""), 
    userAgent_s = column_ifexists("userAgent_s", ""), 
    clientIP_s = column_ifexists("clientIP_s", ""),  
    clientPort_d = column_ifexists("originalRequestUriWithArgs_s", ""),
    host_s = column_ifexists("host_s", ""),
    requestUri_s = column_ifexists("requestUri_s", ""),
    httpStatus_d = column_ifexists("httpStatus_d",""),
    listenerName_s = column_ifexists("listenerName_s", ""),
    httpMethod_s = column_ifexists("httpMethod_s", "")
 | where httpMethod_s =~ 'POST'
 | where originalRequestUriWithArgs_s has_any (spring4shellstring) or requestUri_s has_any (spring4shellstring)
 | summarize Total = count() by originalRequestUriWithArgs_s, userAgent_s, clientIP_s,clientPort_d, TimeGenerated, host_s, requestUri_s, httpStatus_d,listenerName_s, httpMethod_s, Category
 | extend IPCustomEntity = clientIP_s, timestamp = TimeGenerated, UrlCustomEntity = requestUri_s, HostCustomEntity = host_s
entityMappings: 
- entityType: IP
  fieldMappings:
    - identifier: Address
      columnName: IPCustomEntity
- entityType: URL
  fieldMappings:
      - identifier: Url
        columnName: UrlCustomEntity
- entityType: Host
  fieldMappings:
      - identifier: FullName
        columnName: HostCustomEntity

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.