Cassandra JavaScript UDF Creation

  1[metadata]
  2creation_date = "2026/07/30"
  3integration = ["network_traffic"]
  4maturity = "production"
  5updated_date = "2026/07/30"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10Identifies Cassandra Query Language statements that create a JavaScript user-defined function. On vulnerable and
 11dangerously configured Cassandra servers, adversaries can abuse scripted UDF creation to escape the JavaScript sandbox
 12and execute operating-system commands, including through CVE-2021-44521.
 13"""
 14false_positives = [
 15    """
 16    Developers or database administrators may deploy approved JavaScript UDFs in environments where scripted functions
 17    are intentionally enabled. Validate the function body, client address, Cassandra version, configuration, and change
 18    window before escalating.
 19    """,
 20]
 21from = "now-9m"
 22index = ["logs-network_traffic.cassandra-*"]
 23language = "eql"
 24license = "Elastic License v2"
 25name = "Cassandra JavaScript UDF Creation"
 26note = """## Triage and analysis
 27
 28### Investigating Cassandra JavaScript UDF Creation
 29
 30CVE-2021-44521 allows a JavaScript UDF to escape the Nashorn sandbox when Cassandra is vulnerable and scripted UDFs are enabled with unsafe thread settings. Even on patched systems, JavaScript UDF creation is a sensitive control-plane operation that should be rare and restricted to approved administrators.
 31
 32### Possible investigation steps
 33
 34- Review `client.ip`, `server.ip`, `network.community_id`, and `network_traffic.cassandra.request.query`.
 35- Extract the function name, keyspace, declared language, and function body.
 36- Look for Java interoperability, reflection, process execution, class loading, file access, or network-access strings in the UDF body.
 37- Confirm the Cassandra version and the values of `enable_user_defined_functions`, `enable_scripted_user_defined_functions`, and `enable_user_defined_functions_threads`.
 38- Correlate with Cassandra audit logs and endpoint telemetry for child processes, file creation, or outbound connections from the Cassandra service.
 39
 40### False positive analysis
 41
 42- Approved application deployments may create JavaScript UDFs, though this should be uncommon.
 43- Scope exceptions to known deployment clients and reviewed function definitions rather than excluding UDF creation globally.
 44
 45### Response and remediation
 46
 47- Terminate unauthorized sessions and isolate the Cassandra node if code execution is suspected.
 48- Disable scripted UDFs where they are not required and upgrade Cassandra to a version that fixes CVE-2021-44521.
 49- Remove unauthorized functions, rotate affected credentials, and review role permissions and cluster-wide activity.
 50"""
 51references = [
 52    "https://jfrog.com/blog/cve-2021-44521-exploiting-apache-cassandra-user-defined-functions-for-remote-code-execution/",
 53    "https://nvd.nist.gov/vuln/detail/CVE-2021-44521",
 54    "https://attack.mitre.org/techniques/T1059/007/",
 55]
 56risk_score = 73
 57rule_id = "b3e2c2ad-9a81-4638-bf12-7ca2feed66a2"
 58setup = """## Setup
 59
 60This rule requires the Elastic Network Packet Capture integration with the Cassandra protocol analyzer enabled and
 61cleartext visibility into native CQL traffic. Prepared statements expose query text during `PREPARE`, while later
 62`EXECUTE` frames may not repeat it. TLS-encrypted traffic is opaque. Use Cassandra audit logs and endpoint telemetry to
 63confirm the database identity and execution outcome.
 64"""
 65severity = "high"
 66tags = [
 67    "Domain: Network",
 68    "Use Case: Network Security Monitoring",
 69    "Use Case: Threat Detection",
 70    "Use Case: Vulnerability",
 71    "Tactic: Execution",
 72    "Data Source: Network Packet Capture",
 73    "Resources: Investigation Guide",
 74]
 75timestamp_override = "event.ingested"
 76type = "eql"
 77
 78query = '''
 79any where data_stream.dataset == "network_traffic.cassandra" and
 80    network_traffic.cassandra.request.query like~ "*create*function*" and
 81    network_traffic.cassandra.request.query like~ "*language*javascript*"
 82'''
 83
 84
 85[[rule.threat]]
 86framework = "MITRE ATT&CK"
 87[[rule.threat.technique]]
 88id = "T1059"
 89name = "Command and Scripting Interpreter"
 90reference = "https://attack.mitre.org/techniques/T1059/"
 91[[rule.threat.technique.subtechnique]]
 92id = "T1059.007"
 93name = "JavaScript"
 94reference = "https://attack.mitre.org/techniques/T1059/007/"
 95
 96
 97
 98[rule.threat.tactic]
 99id = "TA0002"
100name = "Execution"
101reference = "https://attack.mitre.org/tactics/TA0002/"