Sigma rule: Log4j RCE CVE-2021-44228 Generic

Rule

Title

Log4j RCE CVE-2021-44228 Generic

Status

test

Level

high

Author

Florian Roth (Nextron Systems)

Date

2021-12-10

Modified

2022-02-06

File

rules-emerging-threats/2021/Exploits/CVE-2021-44228/web_cve_2021_44228_log4j.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects exploitation attempt against log4j RCE vulnerability reported as CVE-2021-44228 (Log4Shell)

Log source

category

webserver

Detection

keywords:
    - '${jndi:ldap:/'
    - '${jndi:rmi:/'
    - '${jndi:ldaps:/'
    - '${jndi:dns:/'
    - '/$%7bjndi:'
    - '%24%7bjndi:'
    - '$%7Bjndi:'
    - '%2524%257Bjndi'
    - '%2F%252524%25257Bjndi%3A'
    - '${jndi:${lower:'
    - '${::-j}${'
    - '${jndi:nis'
    - '${jndi:nds'
    - '${jndi:corba'
    - '${jndi:iiop'
    - 'Reference Class Name: foo'
    - '${${env:BARFOO:-j}'
    - '${::-l}${::-d}${::-a}${::-p}'
    - '${base64:JHtqbmRp'
    - '${${env:ENV_NAME:-j}ndi${env:ENV_NAME:-:}$'
    - '${${lower:j}ndi:'
    - '${${upper:j}ndi:'
    - '${${::-j}${::-n}${::-d}${::-i}:'
filter:
    - 'w.nessus.org/nessus'
    - '/nessus}'
condition: keywords and not filter

False positives (as the rule lists them)

• Vulnerability scanning

Tags

• attack.initial-access
• attack.t1190
• detection.emerging-threats

MITRE ATT&CK ids this rule names

• T1190

References

• https://web.archive.org/web/20231230220738/https://www.lunasec.io/docs/blog/log4j-zero-day/
• https://news.ycombinator.com/item?id=29504755
• https://github.com/tangxiaofeng7/apache-log4j-poc
• https://gist.github.com/Neo23x0/e4c8b03ff8cdf1fa63b7d15db6e3860b
• https://github.com/YfryTchsGD/Log4jAttackSurface
• https://twitter.com/shutingrz/status/1469255861394866177?s=21

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules-emerging-threats/2021/Exploits/CVE-2021-44228/web_cve_2021_44228_log4j.yml