Query: spring4shell_vulnerability

select
  tp_timestamp as timestamp,
request_method as operation,
request_uri as resource,
status,
http_user_agent as actor,
tp_source_ip as source_ip,
tp_id as source_id,
-- Create new aliases to preserve original row data
status as status_src,
timestamp as timestamp_src,
*
exclude (status, timestamp)

from
  apache_access_log
where
  request_uri is not null
  and (
    -- Class pattern indicators
    request_uri ilike '%class.module.classLoader%'
    or request_uri ilike '%class.classLoader%'
    or request_uri ilike '%ClassLoader%'
        
    -- Property access patterns
    or request_uri ilike '%?class.module.classLoader.resources.context.parent.pipeline.first.pattern=%'
    or request_uri ilike '%?class.module.classLoader.resources.context.parent.pipeline.first.suffix=%'
    or request_uri ilike '%?class.module.classLoader.resources.context.parent.pipeline.first.directory=%'
    or request_uri ilike '%?class.module.classLoader.resources.context.parent.pipeline.first.prefix=%'
    or request_uri ilike '%?class.module.classLoader.resources.context.parent.pipeline.first.fileDateFormat=%'
        
    -- URL encoded variants
    or request_uri ilike '%class%2Emodule%2EclassLoader%'
    or request_uri ilike '%tomcatwar.jsp%'
        
    -- Common payloads
    or request_uri ilike '%Pattern=%25%7Bc2%7Di%'
    or request_uri ilike '%class.module.classLoader.DefaultAssertionStatus%'
  )
order by
  tp_timestamp desc;