name: Detect malicious requests to exploit JBoss servers
id: c8bff7a4-11ea-4416-a27d-c5bca472913d
version: 1
date: '2017-09-23'
author: Bhavin Patel, Splunk
type: batch
datamodel:
- Web
description: This search is used to detect malicious HTTP requests crafted to exploit
  jmx-console in JBoss servers. The malicious requests have a long URL length, as
  the payload is embedded in the URL.
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
  as lastTime from datamodel=Web where (Web.http_method="GET" OR Web.http_method="HEAD")
  by Web.http_method, Web.url,Web.url_length Web.src, Web.dest | search Web.url="*jmx-console/HtmlAdaptor?action=invokeOpByName&name=jboss.admin*import*"
  AND Web.url_length > 200 | `drop_dm_object_name("Web")` | `security_content_ctime(firstTime)`
  | `security_content_ctime(lastTime)` | table src, dest_ip, http_method, url, firstTime,
  lastTime | `detect_malicious_requests_to_exploit_jboss_servers_filter`'
how_to_implement: You must ingest data from the web server or capture network data
  that contains web specific information with solutions such as Bro or Splunk Stream,
  and populating the Web data model
known_false_positives: No known false positives for this detection.
references: []
tags:
  analytic_story:
  - JBoss Vulnerability
  - SamSam Ransomware
  asset_type: Web Server
  cis20:
  - CIS 12
  - CIS 4
  - CIS 18
  kill_chain_phases:
  - Delivery
  nist:
  - ID.RA
  - PR.PT
  - PR.IP
  - DE.AE
  - PR.MA
  - DE.CM
  product:
  - Splunk Enterprise
  - Splunk Enterprise Security
  - Splunk Cloud
  required_fields:
  - _time
  - Web.http_method
  - Web.url
  - Web.url_length
  - Web.src
  - Web.dest
  security_domain: network
