Oracle - Oracle WebLogic Exploit CVE-2021-2109

Back


Id	67950168-5740-11ec-bf63-0242ac130002
Rulename	Oracle - Oracle WebLogic Exploit CVE-2021-2109
Description	Detects exploitation of Oracle WebLogic vulnerability CVE-2021-2109
Severity	High
Tactics	InitialAccess
Techniques	T1190
Required data connectors	CustomLogsAma
Kind	Scheduled
Query frequency	10m
Query period	10m
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/OracleWebLogicServer/Analytic Rules/OracleWebLogicExploitCVE-2021-2109.yaml
Version	1.0.3
Arm template	67950168-5740-11ec-bf63-0242ac130002.json

KQL

OracleWebLogicServerEvent
| where HttpRequestMethod =~ "GET"
| where UrlOriginal has_all ("ldap://", "com.bea.console.handles.JndiBindingHandle", "AdminServer")
| extend UrlCustomEntity = UrlOriginal

YAML

description: |
    'Detects exploitation of Oracle WebLogic vulnerability CVE-2021-2109'
version: 1.0.3
triggerThreshold: 0
tactics:
- InitialAccess
queryPeriod: 10m
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/OracleWebLogicServer/Analytic Rules/OracleWebLogicExploitCVE-2021-2109.yaml
triggerOperator: gt
status: Available
id: 67950168-5740-11ec-bf63-0242ac130002
name: Oracle - Oracle WebLogic Exploit CVE-2021-2109
queryFrequency: 10m
severity: High
kind: Scheduled
entityMappings:
- fieldMappings:
  - columnName: UrlCustomEntity
    identifier: Url
  entityType: URL
relevantTechniques:
- T1190
query: |
  OracleWebLogicServerEvent
  | where HttpRequestMethod =~ "GET"
  | where UrlOriginal has_all ("ldap://", "com.bea.console.handles.JndiBindingHandle", "AdminServer")
  | extend UrlCustomEntity = UrlOriginal  
requiredDataConnectors:
- dataTypes:
  - OracleWebLogicServer_CL
  connectorId: CustomLogsAma

ARM