CVE-2022-22970

Sentinel/Defender KQL

DeviceProcessEvents
| where FileName in~ ("java.exe", "javaw.exe")
| where ProcessCommandLine has "MultipartFile" or ProcessCommandLine has "javax.servlet.Part"
| where InitiatingProcessFileName in~ ("tomcat.exe", "catalina.sh", "spring-boot.jar") // Example for Spring Boot/Tomcat
| project Timestamp, DeviceName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine

Splunk SPL

(sourcetype=java OR sourcetype=tomcat OR sourcetype=spring) (MultipartFile OR "javax.servlet.Part")
| rex field=_raw "(?<process_command_line>java.*?MultipartFile|java.*?javax.servlet.Part)"
| table _time, host, process_command_line

Sigma

title: Spring Framework DoS via Data Binding
id: 00000000-0000-0000-0000-000000000000
status: experimental
description: Detects potential DoS attempts against Spring Framework applications handling file uploads via data binding to MultipartFile or javax.servlet.Part.
author: SecBoard
date: 2023/10/27
logsource:
  category: process_creation
  product: windows
  service: *
detection:
  selection:
    Image|endswith:
      - '\java.exe'
      - '\javaw.exe'
    CommandLine|contains:
      - 'MultipartFile'
      - 'javax.servlet.Part'
  condition: selection
fields:
  - CommandLine
  - Image
tags:
  - attack.dos
  - cve.2022.22970

Elastic ES|QL

from process where process.name in ("java.exe", "javaw.exe") and (process.args : "*MultipartFile*" or process.args : "*javax.servlet.Part*") and (process.parent.name : "tomcat.exe" or process.parent.name : "catalina.sh" or process.parent.name : "spring-boot.jar")
| select @timestamp, host.name, process.name, process.args, process.parent.name, process.parent.args