Analytics Story: Log4Shell CVE-2021-44228

Date: 2021-12-11 ID: b4453928-5a98-11ec-afcd-8de10b48fc52 Author: Jose Hernandez Product: Splunk Enterprise Security

Description

Log4Shell or CVE-2021-44228 is a Remote Code Execution (RCE) vulnerability in the Apache Log4j library, a widely used and ubiquitous logging framework for Java. The vulnerability allows an attacker who can control log messages to execute arbitrary code loaded from attacker-controlled servers and we anticipate that most apps using the Log4j library will meet this condition.

Why it matters

In late November 2021, Chen Zhaojun of Alibaba identified a remote code execution vulnerability. Previous work was seen in a 2016 Blackhat talk by Alvaro Munoz and Oleksandr Mirosh called "A Journey from JNDI/LDAP Manipulation to Remote Code Execution Dream Land". Reported under the CVE ID : CVE-2021-44228, released to the public on December 10, 2021. The vulnerability is exploited through improper deserialization of user input passed into the framework. It permits remote code execution and it can allow an attacker to leak sensitive data, such as environment variables, or execute malicious software on the target system.

Correlation Search

1| tstats `security_content_summariesonly` min(_time) as firstTime max(_time) as lastTime sum(All_Risk.calculated_risk_score) as risk_score, count(All_Risk.calculated_risk_score) as risk_event_count, values(All_Risk.annotations.mitre_attack.mitre_tactic_id) as annotations.mitre_attack.mitre_tactic_id, dc(All_Risk.annotations.mitre_attack.mitre_tactic_id) as mitre_tactic_id_count, values(All_Risk.annotations.mitre_attack.mitre_technique_id) as annotations.mitre_attack.mitre_technique_id, dc(All_Risk.annotations.mitre_attack.mitre_technique_id) as mitre_technique_id_count, values(All_Risk.tag) as tag, values(source) as source, dc(source) as source_count from datamodel=Risk.All_Risk where All_Risk.analyticstories="Log4Shell CVE-2021-44228" All_Risk.risk_object_type="system" by All_Risk.risk_object All_Risk.risk_object_type All_Risk.annotations.mitre_attack.mitre_tactic | `drop_dm_object_name(All_Risk)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | where source_count >= 2 | `log4shell_cve_2021_44228_exploitation_filter`

Detections

Name ▲▼	Technique ▲▼	Type ▲▼
Any Powershell DownloadFile	Command and Scripting Interpreter, PowerShell, Ingress Tool Transfer	TTP
CMD Carry Out String Command Parameter	Windows Command Shell, Command and Scripting Interpreter	Hunting
Curl Download and Bash Execution	Ingress Tool Transfer	TTP
Java Class File download by Java User Agent	Exploit Public-Facing Application	TTP
Linux Java Spawning Shell	Exploit Public-Facing Application, External Remote Services	TTP
Outbound Network Connection from Java Using Default Ports	Exploit Public-Facing Application, External Remote Services	TTP
PowerShell - Connect To Internet With Hidden Window	PowerShell, Command and Scripting Interpreter	Hunting
Wget Download and Bash Execution	Ingress Tool Transfer	TTP
Windows Java Spawning Shells	Exploit Public-Facing Application, External Remote Services	TTP
Detect Outbound LDAP Traffic	Exploit Public-Facing Application, Command and Scripting Interpreter	Hunting
Hunting for Log4Shell	Exploit Public-Facing Application, External Remote Services	Hunting
Log4Shell JNDI Payload Injection Attempt	Exploit Public-Facing Application, External Remote Services	Anomaly
Log4Shell JNDI Payload Injection with Outbound Connection	Exploit Public-Facing Application, External Remote Services	Anomaly

Data Sources

Name ▲▼	Platform ▲▼	Sourcetype ▲▼	Source ▲▼
Bro	N/A	`bro:http:json`	`bro:http:json`
CrowdStrike ProcessRollup2	N/A	`crowdstrike:events:sensor`	`crowdstrike`
Nginx Access	N/A	`nginx:plus:kv`	`/var/log/nginx/access.log`
Splunk Stream HTTP	Splunk	`stream:http`	`stream:http`
Sysmon EventID 1	Windows	`xmlwineventlog`	`XmlWinEventLog:Microsoft-Windows-Sysmon/Operational`
Sysmon EventID 3	Windows	`xmlwineventlog`	`XmlWinEventLog:Microsoft-Windows-Sysmon/Operational`
Sysmon for Linux EventID 1	Linux	`sysmon:linux`	`Syslog:Linux-Sysmon/Operational`
Windows Event Log Security 4688	Windows	`xmlwineventlog`	`XmlWinEventLog:Security`

References

Source: GitHub | Version: 1