Anvilogic medium experimental spl

Potential CVE-2021-44228 - Log4Shell [splunk-edr]

A vulnerability identified in Java logging library "log4j" that could result in remote code execution. This use case identifies exploitation attempts in compressed files in folder /var/log -- Threat Actor Association: Andariel, APT28, Magic Hound (aka APT35, Charming Kitten, Phosphorus, and Mint Sandstorm), APT41, Karakurt, Lazarus, Stonefly, Teal Kurma (aka Sea Turtle, Marbled Dust, Cosmic Wolf) -- Software Association: Conti, WhisperGate - #TrendingThreat #Russia #Ukraine

View Source

Detection Logic

`get_endpoint_data` `get_endpoint_data_edr` "\$\{jndi" 
OR (TERM(j) TERM(n) TERM(d) TERM(i)) 
OR "lower" 
OR "upper" 
OR (TERM(jn) TERM(DI)) 
OR (TERM(J) TERM(ndi)) 
OR (TERM(jnd) TERM(i)) 
OR TERM(jndi)
| regex _raw="(?i)(\$\{.*?j.*?n.*?d.*?i.*?\:.*?\:\//.*?\})
| JNDI.*?\[.*?\:\/\/.*?\]"
| rex field=_raw (?<string>"(?i)(\$\{.*?j.*?n.*?d.*?i.*?\:.*?\:\//.*?\})
| JNDI.*?\[.*?\:\/\/.*?\]")
| table _time, host, user, process, process_*, string
| bin span=1s
| stats values(*) as * by _time, host

Field Validations

Loading…

Comments (0)

Loading comments...