developers or database administrators may deploy approved javascript udfs in environments where scripted functions are intentionally enabled. validate the function body, client address, cassandra version, configuration, and change window before escalating.

t1059
network
elastic

Techniques

T1059

Sample rules

Cassandra JavaScript UDF Creation

source: elastic
technicques:
- T1059

Description

Identifies Cassandra Query Language statements that create a JavaScript user-defined function. On vulnerable and dangerously configured Cassandra servers, adversaries can abuse scripted UDF creation to escape the JavaScript sandbox and execute operating-system commands, including through CVE-2021-44521.

Detection logic

any where data_stream.dataset == "network_traffic.cassandra" and
    network_traffic.cassandra.request.query like~ "*create*function*" and
    network_traffic.cassandra.request.query like~ "*language*javascript*"