Suspicious failed HTTP request - potential Spring4Shell exploit

Cortex Toolbox Ingest Calculator Platform Changes

Detectors ▾

All detectors Statistics ATT&CK matrix

Analytics Alerts BIOCs Correlation Rules

Content ▾

Packs Integrations MCP Servers Threat Feeds Reputation Commands

Automation

Playbooks Scripts Jobs Automation Rules Lists

Case and Issue Setup

Incident Fields Layouts Layout Rules

Threat Intelligence

Indicator Types Indicator Fields Reputation Commands Threat Feeds

Data Ingestion

Parsing Rules Modeling Rules XDRC Templates

Dashboards & Reports

XSIAM Dashboards XSIAM Reports

Docs ▾

Documentation XDM Explorer Cortex Versions

Settings ▾

Sign in

Analytics BIOC Low

✕

Suspicious failed HTTP request - potential Spring4Shell exploit

A potentially malicious failed HTTP request was received, possibly as part of a Spring4Shell exploitation attempt.

Module:: Platform Analytics
Data source:: Palo Alto Networks Firewall EAL Logs, XDR Agent

ATT&CK tactics: Initial Access (TA0001)

ATT&CK techniques: Exploit Public-Facing Application (T1190)

Attacker's goals:

Gain the ability to execute code remotely or drop malware.

Investigative actions:

Check if suspicious process executions occurred after the request. Consider limiting access to the vulnerable server.

Test period:: N/A (single event)
Deduplication:: 1 Day

1 variation:

Suspicious HTTP request - potential Spring4Shell exploit Medium (parent: Low)