CVE-2022-22971

Sentinel/Defender KQL

// Monitor for high CPU/memory usage or unusual network traffic on Spring applications with STOMP over WebSocket endpoints
DeviceProcessEvents
| where FileName contains "java" or FileName contains "spring"
| where InitiatingProcessCommandLine contains "stomp" or InitiatingProcessCommandLine contains "websocket"
| summarize (TotalCPU, TotalMemory) = (sum(ProcessPerformance.CPU), sum(ProcessPerformance.Memory)) by DeviceName, bin(Timestamp, 5m)
| where TotalCPU > <threshold_cpu> or TotalMemory > <threshold_memory>
| project Timestamp, DeviceName, TotalCPU, TotalMemory, "Potential DoS via STOMP over WebSocket"

Splunk SPL

# Monitor for high CPU/memory usage or unusual network traffic on Spring applications with STOMP over WebSocket endpoints
index=<your_index> (sourcetype="<your_java_logs>" OR sourcetype="<your_system_performance_logs>")
| where (process_name="java" OR process_name="spring") AND (command_line="*stomp*" OR command_line="*websocket*")
| timechart span=5m sum(cpu_usage) as TotalCPU, sum(memory_usage) as TotalMemory by host
| where TotalCPU > <threshold_cpu> OR TotalMemory > <threshold_memory>
| table _time, host, TotalCPU, TotalMemory, "Potential DoS via STOMP over WebSocket"

Sigma

title: Spring Framework STOMP WebSocket DoS
id: <generate_uuid>
status: experimental
description: Detects potential denial of service attempts against Spring applications using STOMP over WebSocket.
author: SecBoard
date: <current_date>
logsource:
  category: process_creation
  product: linux
  service: auditd
detection:
  selection:
    Image|endswith: 
      - 'java'
      - 'spring'
    CommandLine|contains:
      - 'stomp'
      - 'websocket'
  condition: selection
  timeframe: 5m
  level: high

Elastic ES|QL

// Monitor for high CPU/memory usage or unusual network traffic on Spring applications with STOMP over WebSocket endpoints
from process
| where process.name : ("java", "spring") and process.args : ("stomp", "websocket")
| stats sum(process.cpu.usage) as TotalCPU, sum(process.memory.usage) as TotalMemory by host.name, span(timestamp, 5m)
| where TotalCPU > <threshold_cpu> or TotalMemory > <threshold_memory>
| select timestamp, host.name, TotalCPU, TotalMemory, "Potential DoS via STOMP over WebSocket"