Oracle - Oracle WebLogic Exploit CVE-2021-2109

Back


Id	67950168-5740-11ec-bf63-0242ac130002
Rulename	Oracle - Oracle WebLogic Exploit CVE-2021-2109
Description	Detects exploitation of Oracle WebLogic vulnerability CVE-2021-2109
Severity	High
Tactics	InitialAccess
Techniques	T1190
Required data connectors	CustomLogsAma
Kind	Scheduled
Query frequency	10m
Query period	10m
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/OracleWebLogicServer/Analytic Rules/OracleWebLogicExploitCVE-2021-2109.yaml
Version	1.0.3
Arm template	67950168-5740-11ec-bf63-0242ac130002.json

KQL

OracleWebLogicServerEvent
| where HttpRequestMethod =~ "GET"
| where UrlOriginal has_all ("ldap://", "com.bea.console.handles.JndiBindingHandle", "AdminServer")
| extend UrlCustomEntity = UrlOriginal

YAML

query: |
  OracleWebLogicServerEvent
  | where HttpRequestMethod =~ "GET"
  | where UrlOriginal has_all ("ldap://", "com.bea.console.handles.JndiBindingHandle", "AdminServer")
  | extend UrlCustomEntity = UrlOriginal  
version: 1.0.3
triggerOperator: gt
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/OracleWebLogicServer/Analytic Rules/OracleWebLogicExploitCVE-2021-2109.yaml
status: Available
description: |
    'Detects exploitation of Oracle WebLogic vulnerability CVE-2021-2109'
queryFrequency: 10m
name: Oracle - Oracle WebLogic Exploit CVE-2021-2109
kind: Scheduled
triggerThreshold: 0
id: 67950168-5740-11ec-bf63-0242ac130002
requiredDataConnectors:
- connectorId: CustomLogsAma
  dataTypes:
  - OracleWebLogicServer_CL
severity: High
queryPeriod: 10m
entityMappings:
- fieldMappings:
  - columnName: UrlCustomEntity
    identifier: Url
  entityType: URL
relevantTechniques:
- T1190
tactics:
- InitialAccess

ARM