Oracle - Oracle WebLogic Exploit CVE-2021-2109

Back


Id	67950168-5740-11ec-bf63-0242ac130002
Rulename	Oracle - Oracle WebLogic Exploit CVE-2021-2109
Description	Detects exploitation of Oracle WebLogic vulnerability CVE-2021-2109
Severity	High
Tactics	InitialAccess
Techniques	T1190
Required data connectors	CustomLogsAma
Kind	Scheduled
Query frequency	10m
Query period	10m
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/OracleWebLogicServer/Analytic Rules/OracleWebLogicExploitCVE-2021-2109.yaml
Version	1.0.3
Arm template	67950168-5740-11ec-bf63-0242ac130002.json

KQL

OracleWebLogicServerEvent
| where HttpRequestMethod =~ "GET"
| where UrlOriginal has_all ("ldap://", "com.bea.console.handles.JndiBindingHandle", "AdminServer")
| extend UrlCustomEntity = UrlOriginal

YAML

triggerOperator: gt
queryFrequency: 10m
requiredDataConnectors:
- connectorId: CustomLogsAma
  dataTypes:
  - OracleWebLogicServer_CL
relevantTechniques:
- T1190
entityMappings:
- entityType: URL
  fieldMappings:
  - identifier: Url
    columnName: UrlCustomEntity
query: |
  OracleWebLogicServerEvent
  | where HttpRequestMethod =~ "GET"
  | where UrlOriginal has_all ("ldap://", "com.bea.console.handles.JndiBindingHandle", "AdminServer")
  | extend UrlCustomEntity = UrlOriginal  
triggerThreshold: 0
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/OracleWebLogicServer/Analytic Rules/OracleWebLogicExploitCVE-2021-2109.yaml
queryPeriod: 10m
name: Oracle - Oracle WebLogic Exploit CVE-2021-2109
status: Available
kind: Scheduled
description: |
    'Detects exploitation of Oracle WebLogic vulnerability CVE-2021-2109'
id: 67950168-5740-11ec-bf63-0242ac130002
version: 1.0.3
tactics:
- InitialAccess
severity: High

ARM