Apache Struts REST Plugin / S2-032 Command Injection (CVE-2016-3081)

let struts_markers = dynamic(["method:","getRuntime()",".exec(","ProcessBuilder","_memberAccess","@java.lang.Runtime@","#context","ognl"]);
let decode = (s:string){ url_decode(s) };
union
(
  W3CIISLog
  | extend rawUri = strcat(tostring(csUriStem), "?", tostring(csUriQuery))
  | extend decoded = tolower(decode(rawUri))
),
(
  AppServiceHTTPLogs
  | extend decoded = tolower(decode(strcat(tostring(CsUriStem), "?", tostring(CsUriQuery))))
  | extend csMethod = CsMethod, sIp = tostring(CIp)
)
| where decoded has_any (struts_markers) and decoded contains "method:"
| where decoded has_any (dynamic(["getruntime","processbuilder","_memberaccess","@java.lang.runtime@",".exec("]))
| project TimeGenerated, csMethod, decoded, sIp
| order by TimeGenerated desc

(sourcetype="iis" OR sourcetype="access_combined" OR sourcetype="apache:access")
| eval decoded=urldecode(lower(_raw))
| where like(decoded,"%method:%") AND (like(decoded,"%getruntime%") OR like(decoded,"%processbuilder%") OR like(decoded,"%_memberaccess%") OR like(decoded,"%@java.lang.runtime@%") OR like(decoded,"%.exec(%"))
| table _time, host, clientip, uri_path, uri_query, status, decoded
| sort - _time

sequence by host.name with maxspan=2m
  [ any where stringContains(lower(url.original), "method:") and
      (stringContains(lower(url.original), "getruntime") or
       stringContains(lower(url.original), "processbuilder") or
       stringContains(lower(url.original), "_memberaccess") or
       stringContains(lower(url.original), "@java.lang.runtime@")) ]
  [ process where process.parent.name in ("java","java.exe","catalina.sh","tomcat") and
      process.name in ("sh","bash","cmd.exe","powershell.exe","whoami","id","curl","wget") ]

SELECT QIDNAME(qid) AS event, sourceip, destinationip, "URL", "Request Method", starttime
FROM events
WHERE (LOWER("URL") LIKE '%method:%'
  AND (LOWER("URL") LIKE '%getruntime%' OR LOWER("URL") LIKE '%processbuilder%'
       OR LOWER("URL") LIKE '%_memberaccess%' OR LOWER("URL") LIKE '%@java.lang.runtime@%'
       OR LOWER("URL") LIKE '%.exec(%'))
  OR (LOWER(payload) LIKE '%method:%' AND LOWER(payload) LIKE '%ognl%'))
AND LOGSOURCETYPENAME(devicetype) IN ('Apache HTTP Server','Microsoft IIS','F5 Networks BIG-IP ASM')
ORDER BY starttime DESC LAST 24 HOURS

_sourceCategory=web/access OR _sourceCategory=iis
| tolowercase(_raw) as lc
| where lc matches "*method:*"
| where lc matches "*getruntime*" or lc matches "*processbuilder*" or lc matches "*_memberaccess*" or lc matches "*@java.lang.runtime@*" or lc matches "*.exec(*"
| parse regex "(?<clientip>\d+\.\d+\.\d+\.\d+)" nodrop
| count by clientip, _sourceHost
| sort by _count

rule struts_s2_032_cve_2016_3081 {
  meta:
    author = "argus"
    cve = "CVE-2016-3081"
    severity = "CRITICAL"
  events:
    $e.metadata.event_type = "NETWORK_HTTP"
    (
      re.regex($e.network.http.referral_url, `(?i)method:`) or
      re.regex($e.target.url, `(?i)method:`)
    )
    re.regex($e.target.url, `(?i)(getruntime|processbuilder|_memberaccess|@java\.lang\.runtime@|\.exec\()`)
    $host = $e.principal.ip
  match:
    $host over 5m
  condition:
    $e
}

#event_simpleName=ProcessRollup2
| (ParentBaseFileName=/^(java|java.exe|catalina.sh|tomcat.*)$/i)
| (FileName=/^(sh|bash|cmd.exe|powershell.exe|whoami|id|curl|wget|nc|ncat)$/i)
| table([_time, ComputerName, ParentBaseFileName, FileName, CommandLine])
| sort(_time, order=desc)