cscli scenarios install crowdsecurity/spring4shell_cve-2022-22965Detect probing for cve-2022-22965 aka 'spring4shell'.
As usual, smart attackers might bypass the signature. The pattern itself is inspired by :
1type: trigger2format: 2.03name: crowdsecurity/spring4shell_cve-2022-229654description: "Detect cve-2022-22965 probing"5filter: |6 evt.Meta.log_type in ["http_access-log", "http_error-log"] and7 (Upper(evt.Meta.http_path) contains 'CLASS.MODULE.CLASSLOADER.')8groupby: "evt.Meta.source_ip"9blackhole: 2m10labels:11 remediation: true12 confidence: 313 spoofable: 014 classification:15 - attack.T119016 - cve.CVE-2022-2296517 behavior: "http:exploit"18 label: "Spring4shell CVE-2022-22965"19 service: spring20