Spring4Shell (CVE-2022-22965)

title: Spring4Shell ClassLoader Parameter In Web Request
id: 7931ddcc-5eaf-51ab-8594-31098e8a64b9
status: experimental
description: Detects web requests that bind class.module.classLoader properties, the request shape Microsoft documents for CVE-2022-22965 (Spring4Shell). POST bodies are not in most access logs, so this mainly catches GET-based attempts and scanners.
references:
    - https://www.microsoft.com/en-us/security/blog/2022/04/04/springshell-rce-vulnerability-guidance-for-protecting-against-and-detecting-cve-2022-22965/
author: vuln2shell
date: 2026-10-23
tags:
    - attack.initial-access
    - attack.t1190
    - cve.2022-22965
logsource:
    category: webserver
detection:
    selection:
        cs-uri-query|contains: 'class.module.classLoader'
    condition: selection
falsepositives:
    - Vulnerability scanners
level: high

`stream_http` http_method IN ("POST")
  | stats values(form_data) as http_request_body min(_time) as firstTime max(_time) as lastTime count
    BY src dest http_method
       http_user_agent uri_path url
       bytes_in bytes_out
  | search http_request_body IN ("*class.module.classLoader.resources.context.parent.pipeline.first.fileDateFormat=_*", "*class.module.classLoader.resources.context.parent.pipeline.first.pattern*","*suffix=.jsp*")
  | `security_content_ctime(firstTime)`
  | `security_content_ctime(lastTime)`
  | `web_spring4shell_http_request_class_module_filter`

| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
  WHERE Processes.process_name IN ("java","java.exe", "javaw.exe")
  BY _time Processes.action Processes.dest
     Processes.original_file_name Processes.parent_process Processes.parent_process_exec
     Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name
     Processes.parent_process_path Processes.process Processes.process_exec
     Processes.process_guid Processes.process_hash Processes.process_id
     Processes.process_integrity_level Processes.process_name Processes.process_path
     Processes.user Processes.user_id Processes.vendor_product
| `drop_dm_object_name(Processes)`
| join process_guid [
| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Filesystem
  WHERE Filesystem.file_name="*.jsp*"
  BY _time Filesystem.action Filesystem.dest
     Filesystem.file_access_time Filesystem.file_create_time Filesystem.file_hash
     Filesystem.file_modify_time Filesystem.file_name Filesystem.file_path
     Filesystem.file_acl Filesystem.file_size Filesystem.process_guid
     Filesystem.process_id Filesystem.user Filesystem.vendor_product
| `drop_dm_object_name(Filesystem)`
| fields _time process_guid file_path file_name file_create_time user dest process_name]
| stats count min(_time) as firstTime max(_time) as lastTime
  BY dest process_name process_guid
     file_name file_path file_create_time
     user
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `java_writing_jsp_file_filter`

let spring4shellstring = dynamic(["class.module.classLoader.resources.context.parent.pipeline.first.pattern="]);
AzureDiagnostics
| where Category in ("FrontdoorWebApplicationFirewallLog", "FrontdoorAccessLog", "ApplicationGatewayFirewallLog", "ApplicationGatewayAccessLog")
| extend originalRequestUriWithArgs_s = column_ifexists("originalRequestUriWithArgs_s", ""), 
   userAgent_s = column_ifexists("userAgent_s", ""), 
   clientIP_s = column_ifexists("clientIP_s", ""),  
   clientPort_d = column_ifexists("originalRequestUriWithArgs_s", ""),
   host_s = column_ifexists("host_s", ""),
   requestUri_s = column_ifexists("requestUri_s", ""),
   httpStatus_d = column_ifexists("httpStatus_d",""),
   listenerName_s = column_ifexists("listenerName_s", ""),
   httpMethod_s = column_ifexists("httpMethod_s", "")
| where httpMethod_s =~ 'POST'
| where originalRequestUriWithArgs_s has_any (spring4shellstring) or requestUri_s has_any (spring4shellstring)
| summarize Total = count() by originalRequestUriWithArgs_s, userAgent_s, clientIP_s,clientPort_d, TimeGenerated, host_s, requestUri_s, httpStatus_d,listenerName_s, httpMethod_s, Category
| extend IPCustomEntity = clientIP_s, timestamp = TimeGenerated, UrlCustomEntity = requestUri_s, HostCustomEntity = host_s

DeviceNetworkEvents
| where Timestamp > ago(7d)
| where ActionType =~ "NetworkSignatureInspected"
| where AdditionalFields contains ".jsp?cmd="
| summarize makeset(AdditionalFields, 5), min(Timestamp), max(Timestamp) by DeviceId, DeviceName

/class\.module\.classLoader/i
| groupBy([@host], function=count())

alert http any any -> [$HOME_NET,$HTTP_SERVERS] any (msg:"ET EXPLOIT Possible SpringCore RCE/Spring4Shell Inbound (CVE-2022-22965)"; flow:established,to_server; http.request_body; content:"pipeline.first.pattern="; fast_pattern; content:"pipeline.first.suffix="; content:"pipeline.first.directory="; content:"pipeline.first.prefix="; classtype:attempted-admin; sid:2035678; rev:3; metadata:attack_target Server, created_at 2022_03_31, cve CVE_2022_22965, deployment Perimeter, deployment Internal, confidence Medium, signature_severity Major, tag Exploit, tag CISA_KEV, updated_at 2024_03_08, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1190, mitre_technique_name Exploit_Public_Facing_Application;)

rule EXPL_POC_SpringCore_0day_Webshell_Mar22_1 {
   meta:
      description = "Detects webshell found after SpringCore exploitation attempts POC script"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://twitter.com/vxunderground/status/1509170582469943303"
      date = "2022-03-30"
      score = 70
      id = "e7047c98-3c60-5211-9ad5-2bfdfb35d493"
   strings:
      $x1 = ".getInputStream(); int a = -1; byte[] b = new byte[2048];"
      $x2 = "if(\"j\".equals(request.getParameter(\"pwd\")"
      $x3 = ".getRuntime().exec(request.getParameter(\"cmd\")).getInputStream();"
   condition:
     filesize < 200KB and 1 of them
}