CVE-2020-14060

Sentinel/Defender KQL

DeviceProcessEvents
| where InitiatingProcessCommandLine contains "jackson-databind" and InitiatingProcessCommandLine contains "oadd.org.apache.xalan.lib.sql.JNDIConnectionPool"
| where FileName in ("powershell.exe", "cmd.exe", "sh", "bash") or ProcessCommandLine contains "jndi:ldap" or ProcessCommandLine contains "jndi:rmi"
| project Timestamp, DeviceName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, RemoteIP, RemotePort

Splunk SPL

index=* (sourcetype=linux_audit OR sourcetype=WinEventLog:Security) "jackson-databind" "oadd.org.apache.xalan.lib.sql.JNDIConnectionPool" | (command="powershell.exe" OR command="cmd.exe" OR command="sh" OR command="bash" OR process="jndi:ldap" OR process="jndi:rmi") | table _time, host, user, command, process

Sigma

title: Jackson Databind CVE-2020-14060 Exploitation Attempt
author: SecBoard
date: 2024/07/30
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentCommandLine|contains: 'jackson-databind'
    ParentCommandLine|contains: 'oadd.org.apache.xalan.lib.sql.JNDIConnectionPool'
  selection_child:
    CommandLine|contains: 
      - 'powershell.exe'
      - 'cmd.exe'
      - 'sh'
      - 'bash'
      - 'jndi:ldap'
      - 'jndi:rmi'
  condition: selection_parent and selection_child
level: high

Elastic ES|QL

FROM process WHERE process.parent.command_line : "jackson-databind" AND process.parent.command_line : "oadd.org.apache.xalan.lib.sql.JNDIConnectionPool" AND (process.name : ("powershell.exe", "cmd.exe", "sh", "bash") OR process.command_line : ("jndi:ldap", "jndi:rmi"))