DFIR Malware Investigation Lab – Spring4Shell (CVE-2022-22965)

A comprehensive Digital Forensics & Incident Response (DFIR) project that simulates, detects, and investigates the Spring4Shell (CVE-2022-22965) critical vulnerability. This project demonstrates the complete incident response lifecycle from initial compromise through detection, mitigation, and forensic analysis.

Attack Simulation → Network Capture → Log Analysis → IOC Detection → Firewall Mitigation → Forensic Investigation

Built as a blue team / SOC analyst portfolio project showcasing practical defensive security skills.

Project Overview

This lab environment provides hands-on experience with real-world incident response techniques by recreating a controlled Spring4Shell exploitation scenario. The project encompasses both offensive and defensive perspectives, allowing security professionals to understand attack vectors while implementing detection and mitigation strategies.

Key Features

• Spring4Shell Exploit Simulation – Realistic HTTP RCE payload delivery
• Python-Based WAF – Real-time request inspection and blocking
• Comprehensive Logging – Structured log collection and analysis pipeline
• IOC Detection Engine – JSON-driven threat intelligence matching
• Network Forensics – PCAP analysis using tcpdump and Wireshark
• Memory Forensics Workflow – Volatility3 methodology documentation
• Threat Intelligence – Extended IOC datasets and MITRE ATT&CK mapping
• Modular Architecture – Clean, production-ready code structure

Repository Structure

dfir-malware-investigation/
│
├── analysis/          # Detection scripts and PCAP analysis documentation
├── firewall/          # Custom WAF implementation and configuration
├── iocs/              # IOC definitions and threat intelligence profiles
├── tools/             # Attack simulator and vulnerable web application
├── screenshots/       # Visual demonstration and evidence
├── pcaps/             # Network traffic captures
├── logs/              # Application and firewall logs
└── memory/            # Memory forensics methodology and documentation

How It Works

1. Attack Simulation

The attack simulator sends a specially crafted HTTP POST request exploiting Spring Framework's data binding vulnerability:

Payload: class.module.classLoader.resources.context.parent.pipeline.first
Target: /tomcatwar.jsp
Method: HTTP POST with malicious parameters

This mimics real-world exploitation attempts against vulnerable Spring applications.

2. Firewall Defense Layer

A custom Python-based Web Application Firewall intercepts and analyzes incoming HTTP requests:

• Pattern matching against known Spring4Shell signatures
• Real-time blocking of malicious payloads
• Returns HTTP 403 Forbidden for blocked requests
• Logs all suspicious activity for post-incident analysis

3. Detection Engine

The IOC-based detection system scans logs using structured threat intelligence:

Source: iocs/spring4shell.json

Each detection includes:

• CVE identifier and severity rating
• Payload pattern signatures
• Affected endpoints and parameters
• Recommended response actions

4. Network Forensics

Traffic analysis workflow:

1. Capture packets using tcpdump during attack simulation
2. Extract HTTP streams containing exploit attempts
3. Verify firewall blocking behavior at network level
4. Document evidence chain for incident reporting

Captured artifacts include:

• Malicious HTTP request headers
• Exploit payload in cleartext
• Firewall response confirmation

5. Memory Forensics Methodology

While memory dumps are not included in the repository, comprehensive documentation covers:

• Volatility3 analysis workflow
• Process tree enumeration and suspicious process identification
• Network socket analysis for C2 connections
• Command history extraction from memory artifacts
• Malware injection detection techniques

See memory/README.md for the complete methodology.

Demonstration

Visual evidence of the complete attack and defense workflow:

1. Firewall Running

The Python-based firewall initialized and listening for incoming requests

2. Attack Blocked

Real-time interception of the Spring4Shell exploit attempt

3. Firewall Log Evidence

Detailed logging of the malicious request with payload signatures

4. Detection Alert

IOC-based detection engine identifying the Spring4Shell attack

5. PCAP Network Analysis

Network-level proof of the exploit attempt and firewall response

Technology Stack

Skills Demonstrated

This project showcases proficiency in:

• Incident Response – Full IR lifecycle from detection through remediation
• Network Traffic Analysis – PCAP inspection and protocol analysis
• Detection Engineering – Custom rule development and IOC creation
• Threat Intelligence – Structured IOC design and threat modeling
• Security Engineering – WAF/firewall logic implementation
• Memory Forensics – Volatility analysis methodology
• Secure Development – Gitignore usage, secrets management, modular code
• Documentation – Technical writing and evidence preservation

Threat Intelligence

Two IOC profiles are provided for different use cases:

spring4shell.json (Lightweight)

Compact detection rules optimized for real-time scanning with minimal false positives.

spring4shell_full.json (Comprehensive)

Extended threat profile including:

• Network indicators (IPs, domains, user-agents)
• Host-based artifacts (file paths, registry keys)
• Memory indicators (injected code patterns)
• Detection signatures (Sigma, YARA, Snort)
• MITRE ATT&CK technique references
• Incident response playbook steps

Getting Started

Prerequisites

# Ensure tcpdump is available for network capture
sudo apt install tcpdump  # Debian/Ubuntu
sudo pacman -S tcpdump    # Arch Linux

Quick Start

# 1. Clone the repository
git clone https://github.com/suyash-R-K/dfir-malware-investigation.git
cd dfir-malware-investigation

# 2. Start the firewall
cd firewall
python firewall_rule.py

# 3. In another terminal, run the attack simulator
cd tools
python spring4shell_simulator.py

# 4. Analyze the results
cd ../analysis
python detect_spring4shell.py

Detailed setup instructions are available in each module's subdirectory.

Disclaimer

This project is strictly for educational purposes and authorized security research only.

• Do not use these techniques against systems you do not own or have explicit permission to test
• Unauthorized access to computer systems is illegal under CFAA and similar laws worldwide
• The author assumes no liability for misuse of the tools and techniques demonstrated here
• Always obtain proper authorization before conducting any security testing

Author

Suyesh R K
Security & DFIR Enthusiast

Contributing

Contributions are welcome! Please feel free to submit issues or pull requests for:

• Additional IOC signatures
• Detection rule improvements
• Documentation enhancements
• Bug fixes

Additional Resources

• CVE-2022-22965 Official Advisory
• MITRE ATT&CK Framework
• Volatility3 Documentation
• SANS DFIR Resources

If you find this project helpful, please consider giving it a star!