title: Possible Log4Shell JNDI Exploitation Attempt (obfuscation-tolerant)
id: 99cf5ad3-8cea-4c54-9ac3-30bc81d5b93b
status: experimental
description: >
  Detects the JNDI lookup pattern used to exploit Log4Shell (CVE-2021-44228),
  including the common Lookup-based obfuscations (${lower:}, ${upper:}, ${::-},
  ${env:}, nested ${${...}}) used within days of disclosure. NOTE: full coverage
  requires normalising nested ${...} Lookups before matching; this rule flags the
  tell-tale indicators rather than fully deobfuscating.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2021-44228
  - https://attack.mitre.org/techniques/T1190/
author: Aivistix Research
date: 2026/07/09
tags:
  - attack.initial_access
  - attack.t1190
logsource:
  category: webserver
detection:
  jndi_plain:
    c-uri|re: '(?i)\$\{jndi:(ldap|ldaps|rmi|dns|nis|iiop|corba|nds|http)s?:'
  jndi_obfuscation_tokens:
    c-uri|contains:
      - '${${'
      - '${lower:j'
      - '${upper:j'
      - '${::-j}'
      - '${env:'
      - '${sys:'
      - '${date:'
      - '${main:'
  condition: jndi_plain or jndi_obfuscation_tokens
falsepositives:
  - Legitimate strings that contain ${ } expression syntax
level: high