Sigma rule: Log4j RCE CVE-2021-44228 in Fields

A detection rule from the SigmaHQ repository, shown as its author published it. Dataset version ref-be82b53d5d08, updated 2023-01-02T00:00:00.000Z.

Rule

Title
Log4j RCE CVE-2021-44228 in Fields
Status
test
Level
high
Author
Florian Roth (Nextron Systems)
Date
2021-12-10
Modified
2023-01-02
File
rules-emerging-threats/2021/Exploits/CVE-2021-44228/web_cve_2021_44228_log4j_fields.yml
Commit
ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects exploitation attempt against log4j RCE vulnerability reported as CVE-2021-44228 in different header fields found in web server logs (Log4Shell)

Log source

category
webserver

Detection

selection1:
    cs-user-agent|contains:
        - '${jndi:ldap:/'
        - '${jndi:rmi:/'
        - '${jndi:ldaps:/'
        - '${jndi:dns:/'
        - '/$%7bjndi:'
        - '%24%7bjndi:'
        - '$%7Bjndi:'
        - '%2524%257Bjndi'
        - '%2F%252524%25257Bjndi%3A'
        - '${jndi:${lower:'
        - '${::-j}${'
        - '${jndi:nis'
        - '${jndi:nds'
        - '${jndi:corba'
        - '${jndi:iiop'
        - 'Reference Class Name: foo'
        - '${${env:BARFOO:-j}'
        - '${::-l}${::-d}${::-a}${::-p}'
        - '${base64:JHtqbmRp'
        - '${${env:ENV_NAME:-j}ndi${env:ENV_NAME:-:}$'
        - '${${lower:j}ndi:'
        - '${${upper:j}ndi:'
        - '${${::-j}${::-n}${::-d}${::-i}:'
# selection2:
    # user-agent|contains:
        # - '${jndi:ldap:/'
        # - '${jndi:rmi:/'
        # - '${jndi:ldaps:/'
        # - '${jndi:dns:/'
        # - '/$%7bjndi:'
        # - '%24%7bjndi:'
        # - '$%7Bjndi:'
        # - '%2524%257Bjndi'
        # - '%2F%252524%25257Bjndi%3A'
        # - '${jndi:${lower:'
        # - '${::-j}${'
        # - '${jndi:nis'
        # - '${jndi:nds'
        # - '${jndi:corba'
        # - '${jndi:iiop'
        # - 'Reference Class Name: foo'
        # - '${${env:BARFOO:-j}'
        # - '${::-l}${::-d}${::-a}${::-p}'
        # - '${base64:JHtqbmRp'
        # - '${${env:ENV_NAME:-j}ndi${env:ENV_NAME:-:}$'
        # - '${${lower:j}ndi:'
        # - '${${upper:j}ndi:'
        # - '${${::-j}${::-n}${::-d}${::-i}:'
selection3:
    cs-uri-query|contains:
        - '${jndi:ldap:/'
        - '${jndi:rmi:/'
        - '${jndi:ldaps:/'
        - '${jndi:dns:/'
        - '/$%7bjndi:'
        - '%24%7bjndi:'
        - '$%7Bjndi:'
        - '%2524%257Bjndi'
        - '%2F%252524%25257Bjndi%3A'
        - '${jndi:${lower:'
        - '${::-j}${'
        - '${jndi:nis'
        - '${jndi:nds'
        - '${jndi:corba'
        - '${jndi:iiop'
        - 'Reference Class Name: foo'
        - '${${env:BARFOO:-j}'
        - '${::-l}${::-d}${::-a}${::-p}'
        - '${base64:JHtqbmRp'
        - '${${env:ENV_NAME:-j}ndi${env:ENV_NAME:-:}$'
        - '${${lower:j}ndi:'
        - '${${upper:j}ndi:'
        - '${${::-j}${::-n}${::-d}${::-i}:'
selection4:
    cs-referer|contains:
        - '${jndi:ldap:/'
        - '${jndi:rmi:/'
        - '${jndi:ldaps:/'
        - '${jndi:dns:/'
        - '/$%7bjndi:'
        - '%24%7bjndi:'
        - '$%7Bjndi:'
        - '%2524%257Bjndi'
        - '%2F%252524%25257Bjndi%3A'
        - '${jndi:${lower:'
        - '${::-j}${'
        - '${jndi:nis'
        - '${jndi:nds'
        - '${jndi:corba'
        - '${jndi:iiop'
        - 'Reference Class Name: foo'
        - '${${env:BARFOO:-j}'
        - '${::-l}${::-d}${::-a}${::-p}'
        - '${base64:JHtqbmRp'
        - '${${env:ENV_NAME:-j}ndi${env:ENV_NAME:-:}$'
        - '${${lower:j}ndi:'
        - '${${upper:j}ndi:'
        - '${${::-j}${::-n}${::-d}${::-i}:'
condition: 1 of selection*

False positives (as the rule lists them)

  • Vulnerability scanning

Tags

  • attack.initial-access
  • attack.t1190
  • cve.2021-44228
  • detection.emerging-threats

CVEs this rule names

MITRE ATT&CK ids this rule names

References

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules-emerging-threats/2021/Exploits/CVE-2021-44228/web_cve_2021_44228_log4j_fields.yml

Sources and licences

  • SigmaHQ

    "Log4j RCE CVE-2021-44228 in Fields" by Florian Roth (Nextron Systems) (SigmaHQ). Rule: https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules-emerging-threats/2021/Exploits/CVE-2021-44228/web_cve_2021_44228_log4j_fields.yml.
    Licensed under the Detection Rule License (DRL) 1.1: https://github.com/SigmaHQ/Detection-Rule-License

    Detection Rule License (DRL) 1.1

Cite this page

Dragons Eye Ransomware Tracker, "Sigma rule: Log4j RCE CVE-2021-44228 in Fields",
entity page, dataset version ref-be82b53d5d08, updated 2023-01-02T00:00:00.000Z,
https://ransomware-tracker.com/detections/sigma/9be472ed-893c-4ec0-94da-312d2765f654 (accessed 2026-11-03).
Underlying source: SigmaHQ rule 9be472ed-893c-4ec0-94da-312d2765f654, commit ccbb0369507f796db0b0ae6854c8a2be471b9d84.

Pages change. The dataset version identifies the data, but no archive of old versions is kept, so this citation cannot be replayed later.