oracle_weblogic_exploit

rule oracle_weblogic_exploit {
 meta:
    author = "Florian Roth"
    description = "Detects access to a webshell droped into a keytore folder on the WebLogic server  License: https://github.com/Neo23x0/sigma/blob/master/LICENSE.Detection.Rules.md."
    reference = "https://tdm.socprime.com/tdm/info/RrDhc6IkhsDq"
    version = "0.01"
    created = "2018/07/22"
    category = "webserver"
    mitre = "t1100, t1190, initial_access, persistence, privilege_escalation, cve.2018-2894"

  events:
re.regex($selection.target.url, `.*/config/keystore/.*\.js.*`)

  condition:
    $selection
}