Detection rules › Sigma
Oracle WebLogic Exploit
Detects access to a webshell dropped into a keystore folder on the WebLogic server
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Initial Access | T1190 Exploit Public-Facing Application |
| Persistence | T1505.003 Server Software Component: Web Shell |
Rule body yaml
title: Oracle WebLogic Exploit
id: 37e8369b-43bb-4bf8-83b6-6dd43bda2000
status: test
description: Detects access to a webshell dropped into a keystore folder on the WebLogic server
references:
- https://twitter.com/pyn3rd/status/1020620932967223296
- https://github.com/LandGrey/CVE-2018-2894
author: Florian Roth (Nextron Systems)
date: 2018-07-22
modified: 2023-01-02
tags:
- attack.t1190
- attack.initial-access
- attack.persistence
- attack.t1505.003
- cve.2018-2894
- detection.emerging-threats
logsource:
category: webserver
detection:
selection:
cs-uri-query: '*/config/keystore/*.js*'
condition: selection
falsepositives:
- Unknown
level: critical
Stages and Predicates
Stage 0: condition
selectionStage 1: selection
selection:
cs-uri-query: '*/config/keystore/*.js*'
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
cs-uri-query | wildcard |
|