Oracle - Oracle WebLogic Exploit CVE-2021-2109

Back


Id	67950168-5740-11ec-bf63-0242ac130002
Rulename	Oracle - Oracle WebLogic Exploit CVE-2021-2109
Description	Detects exploitation of Oracle WebLogic vulnerability CVE-2021-2109
Severity	High
Tactics	InitialAccess
Techniques	T1190
Required data connectors	CustomLogsAma
Kind	Scheduled
Query frequency	10m
Query period	10m
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/OracleWebLogicServer/Analytic Rules/OracleWebLogicExploitCVE-2021-2109.yaml
Version	1.0.3
Arm template	67950168-5740-11ec-bf63-0242ac130002.json

KQL

OracleWebLogicServerEvent
| where HttpRequestMethod =~ "GET"
| where UrlOriginal has_all ("ldap://", "com.bea.console.handles.JndiBindingHandle", "AdminServer")
| extend UrlCustomEntity = UrlOriginal

YAML

relevantTechniques:
- T1190
entityMappings:
- entityType: URL
  fieldMappings:
  - columnName: UrlCustomEntity
    identifier: Url
version: 1.0.3
id: 67950168-5740-11ec-bf63-0242ac130002
severity: High
kind: Scheduled
queryFrequency: 10m
description: |
    'Detects exploitation of Oracle WebLogic vulnerability CVE-2021-2109'
requiredDataConnectors:
- connectorId: CustomLogsAma
  dataTypes:
  - OracleWebLogicServer_CL
triggerOperator: gt
name: Oracle - Oracle WebLogic Exploit CVE-2021-2109
tactics:
- InitialAccess
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/OracleWebLogicServer/Analytic Rules/OracleWebLogicExploitCVE-2021-2109.yaml
triggerThreshold: 0
queryPeriod: 10m
query: |
  OracleWebLogicServerEvent
  | where HttpRequestMethod =~ "GET"
  | where UrlOriginal has_all ("ldap://", "com.bea.console.handles.JndiBindingHandle", "AdminServer")
  | extend UrlCustomEntity = UrlOriginal  
status: Available

ARM