CVE-2019-2725

Sentinel/Defender KQL

DeviceProcessEvents
| where InitiatingProcessFileName =~ "java.exe" or InitiatingProcessCommandLine contains "weblogic.Server"
| where FileName in ("powershell.exe", "cmd.exe", "sh", "bash")
| where ProcessCommandLine contains "-e" or ProcessCommandLine contains "-c" or ProcessCommandLine contains "-nop" or ProcessCommandLine contains "-w hidden"
| project Timestamp, DeviceName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, RemoteIP, RemotePort

Splunk SPL

index=* (sourcetype=WinEventLog:Microsoft-Windows-Sysmon/Operational OR sourcetype=linux_audit) 
(ParentProcessName="java.exe" OR ParentCommandLine="*weblogic.Server*") 
(ProcessName="powershell.exe" OR ProcessName="cmd.exe" OR ProcessName="sh" OR ProcessName="bash") 
(CommandLine="*-e*" OR CommandLine="*-c*" OR CommandLine="*-nop*" OR CommandLine="*-w hidden*")

Sigma

title: WebLogic RCE via Deserialization (CVE-2019-2725)
status: experimental
description: Detects suspicious process creation by Oracle WebLogic Server, indicative of a deserialization RCE exploit.
references:
    - https://www.exploit-db.com/exploits/46780/
logsource:
    category: process_creation
target_product: windows
detection:
    selection:
        ParentImage|endswith:
            - '\java.exe'
        ParentCommandLine|contains:
            - 'weblogic.Server'
        Image|endswith:
            - '\powershell.exe'
            - '\cmd.exe'
            - '\sh'
            - '\bash'
        CommandLine|contains:
            - '-e'
            - '-c'
            - '-nop'
            - '-w hidden'
    condition: selection
falsepositives:
    - Legitimate administrative scripts or deployments if not properly filtered.
level: high

Elastic ES|QL

from process where 
  (process.parent.executable : "java.exe" or process.parent.command_line : "*weblogic.Server*") and 
  (process.executable : ("powershell.exe", "cmd.exe", "sh", "bash")) and 
  (process.command_line : ("*-e*", "*-c*", "*-nop*", "*-w hidden*"))