XQL - Hunt for Possible Spring4Shell Vulnerable Application

Showing results for 
Show  only  | Search instead for 
Did you mean: 

XQL - Hunt for Possible Spring4Shell Vulnerable Application

L3 Networker


Spring4Shell Vulnerability Exists in the Spring Framework. Java based application are developed using this framework, we would not see direct installation of spring framework on the system but as part of a Java application. (At least what I have seen.)



Our goal is to find out where can we see the traces of spring-beans and spring-core in our environment which will help us identify the application using spring framework and what hosts the application is on for patching of the software.


The first XQL looks for any file "writes and create" where key word is spring-beans and spring-core:


config case_sensitive = false
| dataset = xdr_data
| filter event_sub_type = ENUM.FILE_WRITE or event_sub_type = ENUM.FILE_CREATE_NEW
| filter action_file_name contains "spring-beans" or action_file_name contains "spring-core"
| filter action_file_name ~= ".*spring-(beans|core)-\d.\d.\d.*"
| fields
_time as Timestamp,
agent_hostname as Hostname,
action_file_name as File_Name,action_file_path as File_Path,actor_process_image_name as Proces_Name
| comp count_distinct(Hostname) as Count by File_Name,Hostname,File_Path
| sort desc Count



The second XQL looks for any process start which has command-line parameter such as "spring-core and spring-beans":


config case_sensitive = false | dataset = xdr_data
| filter event_sub_type = ENUM.PROCESS_START
| filter action_process_image_command_line contains "spring-beans" or action_process_image_command_line contains "spring-core"
| filter action_process_image_command_line ~= ".*spring-(beans|core)-\d.\d.\d.*"
| fields
_time as Timestamp,
agent_hostname as Hostname,
action_process_image_name as Process_Name,action_process_image_command_line as Process_CMD
| comp count_distinct(Process_Name) as Count by Hostname,Process_Name,Process_CMD
| sort desc Count




Having a vulnerable version of spring framework does not mean that an exploit will be successful as there are other pre-requites as well. But it is good to have the software patched. "Hence the hunt"

More information: https://unit42.paloaltonetworks.com/cve-2022-22965-springshell/


Thoughts? Suggestions? All welcome and I hope this helps others too.

Kind Regards

L0 Member

This is awesome to detect both ways - thanks so much!!!

  • 1 replies
  • 78 Subscriptions
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!