alert http any any -> any any (msg:"ATTACK [PTsecurity] log4j RCE aka Log4Shell HTTP URI URL-encoded attempt (CVE-2021-44228)"; flow:established; content:"${"; http_uri; content:"j"; http_uri; distance:0; nocase; content:"n"; http_uri; distance:0; nocase; content:"d"; http_uri; distance:0; nocase; content:"i"; http_uri; distance:0; nocase; content:":"; http_uri; distance:0; nocase; pcre:"/\${(?:\${date:}|\${date:\'|\${upper:|\${lower:|\${env:[^:]*:-\}?|\${.*?:-)*}*j\'*}*(?:\${date:}|\${date:\'|\${upper:|\${lower:|\${env:[^:]*:-\}?|\${.*?:-)*}*n\'*}*(?:\${date:}|\${date:\'|\${upper:|\${lower:|\${env:[^:]*:-\}?|\${.*?:-)*}*d\'*}*(?:\${date:}|\${date:\'|\${upper:|\${lower:|\${env:[^:]*:-\}?|\${.*?:-)*}*i\'*}*(?:\${date:}|\${date:\'|\${upper:|\${lower:|\${env:[^:]*:-\}?|\${.*?:-)*}*:\'*}*(?:(?:\${date:}|\${date:\'|\${upper:|\${lower:|\${env:[^:]*:-\}?|\${.*?:-)*}*l\'*}*(?:\${date:}|\${date:\'|\${upper:|\${lower:|\${env:[^:]*:-\}?|\${.*?:-)*}*d\'*}*(?:\${date:}|\${date:\'|\${upper:|\${lower:|\${env:[^:]*:-\}?|\${.*?:-)*}*a\'*}*(?:\${date:}|\${date:\'|\${upper:|\${lower:|\${env:[^:]*:-\}?|\${.*?:-)*}*p\'*}*|(?:\${date:}|\${date:\'|\${upper:|\${lower:|\${env:[^:]*:-\}?|\${.*?:-)*}*d\'*}*(?:\${date:}|\${date:\'|\${upper:|\${lower:|\${env:[^:]*:-\}?|\${.*?:-)*}*n\'*}*(?:\${date:}|\${date:\'|\${upper:|\${lower:|\${env:[^:]*:-\}?|\${.*?:-)*}*s\'*}*|(?:\${date:}|\${date:\'|\${upper:|\${lower:|\${env:[^:]*:-\}?|\${.*?:-)*}*r\'*}*(?:\${date:}|\${date:\'|\${upper:|\${lower:|\${env:[^:]*:-\}?|\${.*?:-)*}*m\'*}*(?:\${date:}|\${date:\'|\${upper:|\${lower:|\${env:[^:]*:-\}?|\${.*?:-)*}*i\'*}*|(?:\${date:}|\${date:\'|\${upper:|\${lower:|\${env:[^:]*:-\}?|\${.*?:-)*}*i\'*}*(?:\${date:}|\${date:\'|\${upper:|\${lower:|\${env:[^:]*:-\}?|\${.*?:-)*}*i\'*}*(?:\${date:}|\${date:\'|\${upper:|\${lower:|\${env:[^:]*:-\}?|\${.*?:-)*}*o\'*}*(?:\${date:}|\${date:\'|\${upper:|\${lower:|\${env:[^:]*:-\}?|\${.*?:-)*}*p\'*}*)/Ui"; reference:cve, 2021-44228; reference:url, www.lunasec.io/docs/blog/log4j-zero-day; reference:url, rules.ptsecurity.com; classtype:attempted-admin; sid:10006897; rev:7;)