Skip to content

Instantly share code, notes, and snippets.

@Neo23x0

Neo23x0/log4j_rce_detection.md

Last active October 4, 2025 08:06
Show Gist options
  • Save Neo23x0/e4c8b03ff8cdf1fa63b7d15db6e3860b to your computer and use it in GitHub Desktop.
Save Neo23x0/e4c8b03ff8cdf1fa63b7d15db6e3860b to your computer and use it in GitHub Desktop.
Download ZIP

Revisions

  1. Neo23x0 revised this gist Dec 16, 2021. 1 changed file with 10 additions and 1 deletion.
    11 changes: 10 additions & 1 deletion log4j_rce_detection.md
    View file
    Original file line number Diff line number Diff line change
    @@ -46,7 +46,16 @@ Python based scanner to detect the most obfuscated forms of the exploit codes.

    https://github.com/Neo23x0/log4shell-detector

    ## Find Vulnerable Software (Windows)
    ## Find Log4j on Linux

    ```
    ps aux | egrep '[l]og4j'
    find / -iname "log4j*"
    lsof | grep log4j
    grep -r --include *.[wj]ar "JndiLookup.class" / 2>&1 | grep matches
    ```

    ## Find Vulnerable Log4j on Windows

    ```powershell
    gci 'C:\' -rec -force -include *.jar -ea 0 | foreach {select-string "JndiLookup.class" $_} | select -exp Path
  2. Neo23x0 revised this gist Dec 16, 2021. 1 changed file with 8 additions and 0 deletions.
    8 changes: 8 additions & 0 deletions log4j_rce_detection.md
    View file
    Original file line number Diff line number Diff line change
    @@ -32,6 +32,14 @@ This command searches for exploitation attempts in compressed files in folder `/
    sudo find /var/log/ -name '*.gz' -type f -exec sh -c "zcat {} | sed -e 's/\${lower://'g | tr -d '}' | egrep -i 'jndi:(ldap[s]?|rmi|dns|nis|iiop|corba|nds|http):'" \;
    ```

    ## Log4Shell-Rex

    A massive regex to cover even the most obfuscated variants: https://github.com/back2root/log4shell-rex

    ```regex
    (?:\$|%(?:25)*24|\\(?:0024|0{0,2}44))(?:{|%(?:25)*7[Bb]|\\(?:007[Bb]|0{0,2}173)).{0,30}?((?:[Jj]|%(?:25)*[46][Aa]|\\(?:00[46][Aa]|0{0,2}1[15]2)).{0,30}?(?:[Nn]|%(?:25)*[46][Ee]|\\(?:00[46][Ee]|0{0,2}1[15]6)).{0,30}?(?:[Dd]|%(?:25)*[46]4|\\(?:00[46]4|0{0,2}1[04]4)).{0,30}?(?:[Ii]|%(?:25)*[46]9|\\(?:00[46]9|0{0,2}1[15]1)|ı).{0,30}?(?::|%(?:25)*3[Aa]|\\(?:003[Aa]|0{0,2}72)).{0,30}?((?:[Ll]|%(?:25)*[46][Cc]|\\(?:00[46][Cc]|0{0,2}1[15]4)).{0,30}?(?:[Dd]|%(?:25)*[46]4|\\(?:00[46]4|0{0,2}1[04]4)).{0,30}?(?:[Aa]|%(?:25)*[46]1|\\(?:00[46]1|0{0,2}1[04]1)).{0,30}?(?:[Pp]|%(?:25)*[57]0|\\(?:00[57]0|0{0,2}1[26]0))(?:.{0,30}?(?:[Ss]|%(?:25)*[57]3|\\(?:00[57]3|0{0,2}1[26]3)))?|(?:[Rr]|%(?:25)*[57]2|\\(?:00[57]2|0{0,2}1[26]2)).{0,30}?(?:[Mm]|%(?:25)*[46][Dd]|\\(?:00[46][Dd]|0{0,2}1[15]5)).{0,30}?(?:[Ii]|%(?:25)*[46]9|\\(?:00[46]9|0{0,2}1[15]1)|ı)|(?:[Dd]|%(?:25)*[46]4|\\(?:00[46]4|0{0,2}1[04]4)).{0,30}?(?:[Nn]|%(?:25)*[46][Ee]|\\(?:00[46][Ee]|0{0,2}1[15]6)).{0,30}?(?:[Ss]|%(?:25)*[57]3|\\(?:00[57]3|0{0,2}1[26]3))|(?:[Nn]|%(?:25)*[46][Ee]|\\(?:00[46][Ee]|0{0,2}1[15]6)).{0,30}?(?:[Ii]|%(?:25)*[46]9|\\(?:00[46]9|0{0,2}1[15]1)|ı).{0,30}?(?:[Ss]|%(?:25)*[57]3|\\(?:00[57]3|0{0,2}1[26]3))|(?:.{0,30}?(?:[Ii]|%(?:25)*[46]9|\\(?:00[46]9|0{0,2}1[15]1)|ı)){2}.{0,30}?(?:[Oo]|%(?:25)*[46][Ff]|\\(?:00[46][Ff]|0{0,2}1[15]7)).{0,30}?(?:[Pp]|%(?:25)*[57]0|\\(?:00[57]0|0{0,2}1[26]0))|(?:[Cc]|%(?:25)*[46]3|\\(?:00[46]3|0{0,2}1[04]3)).{0,30}?(?:[Oo]|%(?:25)*[46][Ff]|\\(?:00[46][Ff]|0{0,2}1[15]7)).{0,30}?(?:[Rr]|%(?:25)*[57]2|\\(?:00[57]2|0{0,2}1[26]2)).{0,30}?(?:[Bb]|%(?:25)*[46]2|\\(?:00[46]2|0{0,2}1[04]2)).{0,30}?(?:[Aa]|%(?:25)*[46]1|\\(?:00[46]1|0{0,2}1[04]1))|(?:[Nn]|%(?:25)*[46][Ee]|\\(?:00[46][Ee]|0{0,2}1[15]6)).{0,30}?(?:[Dd]|%(?:25)*[46]4|\\(?:00[46]4|0{0,2}1[04]4)).{0,30}?(?:[Ss]|%(?:25)*[57]3|\\(?:00[57]3|0{0,2}1[26]3))|(?:[Hh]|%(?:25)*[46]8|\\(?:00[46]8|0{0,2}1[15]0))(?:.{0,30}?(?:[Tt]|%(?:25)*[57]4|\\(?:00[57]4|0{0,2}1[26]4))){2}.{0,30}?(?:[Pp]|%(?:25)*[57]0|\\(?:00[57]0|0{0,2}1[26]0))(?:.{0,30}?(?:[Ss]|%(?:25)*[57]3|\\(?:00[57]3|0{0,2}1[26]3)))?).{0,30}?(?::|%(?:25)*3[Aa]|\\(?:003[Aa]|0{0,2}72)).{0,30}?(?:\/|%(?:25)*2[Ff]|\\(?:002[Ff]|0{0,2}57)|\${)|(?:[Bb]|%(?:25)*[46]2|\\(?:00[46]2|0{0,2}1[04]2)).{0,30}?(?:[Aa]|%(?:25)*[46]1|\\(?:00[46]1|0{0,2}1[04]1)).{0,30}?(?:[Ss]|%(?:25)*[57]3|\\(?:00[57]3|0{0,2}1[26]3)).{0,30}?(?:[Ee]|%(?:25)*[46]5|\\(?:00[46]5|0{0,2}1[04]5)).{2,60}?(?::|%(?:25)*3[Aa]|\\(?:003[Aa]|0{0,2}72))(JH[s-v]|[\x2b\x2f-9A-Za-z][CSiy]R7|[\x2b\x2f-9A-Za-z]{2}[048AEIMQUYcgkosw]ke[\x2b\x2f-9w-z]))
    ```

    ## Log4Shell Detector (Python)

    Python based scanner to detect the most obfuscated forms of the exploit codes.
  3. Neo23x0 revised this gist Dec 12, 2021. 1 changed file with 4 additions and 4 deletions.
    8 changes: 4 additions & 4 deletions log4j_rce_detection.md
    View file
    Original file line number Diff line number Diff line change
    @@ -7,13 +7,13 @@ You can use these commands and rules to search for exploitation attempts against
    This command searches for exploitation attempts in uncompressed files in folder `/var/log` and all sub folders

    ```bash
    sudo egrep -I -i -r '\$(\{|%7B)jndi:(ldap[s]?|rmi|dns):/[^\n]+' /var/log
    sudo egrep -I -i -r '\$(\{|%7B)jndi:(ldap[s]?|rmi|dns|nis|iiop|corba|nds|http):/[^\n]+' /var/log
    ```

    This command searches for exploitation attempts in compressed files in folder `/var/log` and all sub folders

    ```bash
    sudo find /var/log -name \*.gz -print0 | xargs -0 zgrep -E -i '\$(\{|%7B)jndi:(ldap[s]?|rmi|dns):/[^\n]+'
    sudo find /var/log -name \*.gz -print0 | xargs -0 zgrep -E -i '\$(\{|%7B)jndi:(ldap[s]?|rmi|dns|nis|iiop|corba|nds|http):/[^\n]+'
    ```

    ## Grep / Zgrep - Obfuscated Variants
    @@ -23,13 +23,13 @@ These commands cover even the obfuscated variants but lack the file name in a ma
    This command searches for exploitation attempts in uncompressed files in folder `/var/log` and all sub folders

    ```bash
    sudo find /var/log/ -type f -exec sh -c "cat {} | sed -e 's/\${lower://'g | tr -d '}' | egrep -I -i 'jndi:(ldap[s]?|rmi|dns):'" \;
    sudo find /var/log/ -type f -exec sh -c "cat {} | sed -e 's/\${lower://'g | tr -d '}' | egrep -I -i 'jndi:(ldap[s]?|rmi|dns|nis|iiop|corba|nds|http):'" \;
    ```

    This command searches for exploitation attempts in compressed files in folder `/var/log` and all sub folders

    ```bash
    sudo find /var/log/ -name '*.gz' -type f -exec sh -c "zcat {} | sed -e 's/\${lower://'g | tr -d '}' | egrep -i 'jndi:(ldap[s]?|rmi|dns):'" \;
    sudo find /var/log/ -name '*.gz' -type f -exec sh -c "zcat {} | sed -e 's/\${lower://'g | tr -d '}' | egrep -i 'jndi:(ldap[s]?|rmi|dns|nis|iiop|corba|nds|http):'" \;
    ```

    ## Log4Shell Detector (Python)
  4. Neo23x0 revised this gist Dec 12, 2021. 1 changed file with 1 addition and 1 deletion.
    2 changes: 1 addition & 1 deletion log4j_rce_detection.md
    View file
    Original file line number Diff line number Diff line change
    @@ -29,7 +29,7 @@ sudo find /var/log/ -type f -exec sh -c "cat {} | sed -e 's/\${lower://'g | tr -
    This command searches for exploitation attempts in compressed files in folder `/var/log` and all sub folders

    ```bash
    sudo find /var/log/ -name "*.log.gz" -type f -exec sh -c "zcat {} | sed -e 's/\${lower://'g | tr -d '}' | egrep -i 'jndi:(ldap[s]?|rmi|dns):'" \;
    sudo find /var/log/ -name '*.gz' -type f -exec sh -c "zcat {} | sed -e 's/\${lower://'g | tr -d '}' | egrep -i 'jndi:(ldap[s]?|rmi|dns):'" \;
    ```

    ## Log4Shell Detector (Python)
  5. Neo23x0 revised this gist Dec 12, 2021. 1 changed file with 1 addition and 0 deletions.
    1 change: 1 addition & 0 deletions log4j_rce_detection.md
    View file
    Original file line number Diff line number Diff line change
    @@ -62,3 +62,4 @@ I got help and ideas from
    - [@matthias_kaiser](https://twitter.com/matthias_kaiser)
    - [@daphiel](https://twitter.com/daphiel)
    - [@Reelix](https://twitter.com/Reelix)
    - @atom-b
  6. Neo23x0 revised this gist Dec 12, 2021. 1 changed file with 3 additions and 55 deletions.
    58 changes: 3 additions & 55 deletions log4j_rce_detection.md
    View file
    Original file line number Diff line number Diff line change
    @@ -7,13 +7,13 @@ You can use these commands and rules to search for exploitation attempts against
    This command searches for exploitation attempts in uncompressed files in folder `/var/log` and all sub folders

    ```bash
    sudo egrep -I -i -r '\$\{jndi:(ldap[s]?|rmi|dns):/[^\n]+' /var/log
    sudo egrep -I -i -r '\$(\{|%7B)jndi:(ldap[s]?|rmi|dns):/[^\n]+' /var/log
    ```

    This command searches for exploitation attempts in compressed files in folder `/var/log` and all sub folders

    ```bash
    sudo find /var/log -name \*.gz -print0 | xargs -0 zgrep -E -i '\$\{jndi:(ldap[s]?|rmi|dns):/[^\n]+'
    sudo find /var/log -name \*.gz -print0 | xargs -0 zgrep -E -i '\$(\{|%7B)jndi:(ldap[s]?|rmi|dns):/[^\n]+'
    ```

    ## Grep / Zgrep - Obfuscated Variants
    @@ -49,59 +49,7 @@ by [@CyberRaiju](https://twitter.com/CyberRaiju/status/1469505677580124160)

    ## YARA

    Preliminary YARA rules (work in progress)
    ```yara
    rule EXPL_Log4j_CVE_2021_44228_Dec21_Soft {
    meta:
    description = "Detects indicators in server logs that indicate an exploitation attempt of CVE-2021-44228"
    author = "Florian Roth"
    reference = "https://twitter.com/h113sdx/status/1469010902183661568?s=20"
    date = "2021-12-10"
    score = 60
    strings:
    $x1 = "${jndi:ldap:/"
    $x2 = "${jndi:rmi:/"
    $x3 = "${jndi:ldaps:/"
    $x4 = "${jndi:dns:/"
    condition:
    1 of them
    }
    rule EXPL_Log4j_CVE_2021_44228_Dec21_Hard {
    meta:
    description = "Detects indicators in server logs that indicate the exploitation of CVE-2021-44228"
    author = "Florian Roth"
    reference = "https://twitter.com/h113sdx/status/1469010902183661568?s=20"
    date = "2021-12-10"
    score = 80
    strings:
    $x1 = /\$\{jndi:(ldap|ldaps|rmi|dns):\/[\/]?[a-z-\.0-9]{3,120}:[0-9]{2,5}\/[a-zA-Z\.]{1,32}\}/
    $fp1r = /(ldap|rmi|ldaps|dns):\/[\/]?(127\.0\.0\.1|192\.168\.|172\.[1-3][0-9]\.|10\.)/
    condition:
    $x1 and not 1 of ($fp*)
    }
    rule SUSP_Base64_Encoded_Exploit_Indicators_Dec21 {
    meta:
    description = "Detects base64 encoded strings found in payloads of exploits against log4j CVE-2021-44228"
    author = "Florian Roth"
    reference = "https://twitter.com/Reelix/status/1469327487243071493"
    date = "2021-12-10"
    score = 70
    strings:
    /* curl -s */
    $sa1 = "Y3VybCAtcy"
    $sa2 = "N1cmwgLXMg"
    $sa3 = "jdXJsIC1zI"
    /* |wget -q -O- */
    $sb1 = "fHdnZXQgLXEgLU8tI"
    $sb2 = "x3Z2V0IC1xIC1PLS"
    $sb3 = "8d2dldCAtcSAtTy0g"
    condition:
    1 of ($sa*) and 1 of ($sb*)
    }
    ```
    https://github.com/Neo23x0/signature-base/blob/master/yara/expl_log4j_cve_2021_44228.yar

    ## Help

  7. Neo23x0 revised this gist Dec 11, 2021. 1 changed file with 3 additions and 3 deletions.
    6 changes: 3 additions & 3 deletions log4j_rce_detection.md
    View file
    Original file line number Diff line number Diff line change
    @@ -7,7 +7,7 @@ You can use these commands and rules to search for exploitation attempts against
    This command searches for exploitation attempts in uncompressed files in folder `/var/log` and all sub folders

    ```bash
    sudo egrep -l -i -r '\$\{jndi:(ldap[s]?|rmi|dns):/[^\n]+' /var/log
    sudo egrep -I -i -r '\$\{jndi:(ldap[s]?|rmi|dns):/[^\n]+' /var/log
    ```

    This command searches for exploitation attempts in compressed files in folder `/var/log` and all sub folders
    @@ -23,13 +23,13 @@ These commands cover even the obfuscated variants but lack the file name in a ma
    This command searches for exploitation attempts in uncompressed files in folder `/var/log` and all sub folders

    ```bash
    sudo find /var/log/ -type f -exec sh -c "cat {} | sed -e 's/\${lower://'g | tr -d '}' | egrep -i 'jndi:(ldap[s]?|rmi|dns):'" \;
    sudo find /var/log/ -type f -exec sh -c "cat {} | sed -e 's/\${lower://'g | tr -d '}' | egrep -I -i 'jndi:(ldap[s]?|rmi|dns):'" \;
    ```

    This command searches for exploitation attempts in compressed files in folder `/var/log` and all sub folders

    ```bash
    sudo find /var/log/ -name "*.gz" -type f -exec sh -c "zcat {} | sed -e 's/\${lower://'g | tr -d '}' | egrep -i 'jndi:(ldap[s]?|rmi|dns):'" \;
    sudo find /var/log/ -name "*.log.gz" -type f -exec sh -c "zcat {} | sed -e 's/\${lower://'g | tr -d '}' | egrep -i 'jndi:(ldap[s]?|rmi|dns):'" \;
    ```

    ## Log4Shell Detector (Python)
  8. Neo23x0 revised this gist Dec 11, 2021. 1 changed file with 1 addition and 1 deletion.
    2 changes: 1 addition & 1 deletion log4j_rce_detection.md
    View file
    Original file line number Diff line number Diff line change
    @@ -7,7 +7,7 @@ You can use these commands and rules to search for exploitation attempts against
    This command searches for exploitation attempts in uncompressed files in folder `/var/log` and all sub folders

    ```bash
    sudo egrep -i -r '\$\{jndi:(ldap[s]?|rmi|dns):/[^\n]+' /var/log
    sudo egrep -l -i -r '\$\{jndi:(ldap[s]?|rmi|dns):/[^\n]+' /var/log
    ```

    This command searches for exploitation attempts in compressed files in folder `/var/log` and all sub folders
  9. Neo23x0 revised this gist Dec 11, 2021. 1 changed file with 6 additions and 0 deletions.
    6 changes: 6 additions & 0 deletions log4j_rce_detection.md
    View file
    Original file line number Diff line number Diff line change
    @@ -32,6 +32,12 @@ This command searches for exploitation attempts in compressed files in folder `/
    sudo find /var/log/ -name "*.gz" -type f -exec sh -c "zcat {} | sed -e 's/\${lower://'g | tr -d '}' | egrep -i 'jndi:(ldap[s]?|rmi|dns):'" \;
    ```

    ## Log4Shell Detector (Python)

    Python based scanner to detect the most obfuscated forms of the exploit codes.

    https://github.com/Neo23x0/log4shell-detector

    ## Find Vulnerable Software (Windows)

    ```powershell
  10. Neo23x0 revised this gist Dec 11, 2021. 1 changed file with 9 additions and 0 deletions.
    9 changes: 9 additions & 0 deletions log4j_rce_detection.md
    View file
    Original file line number Diff line number Diff line change
    @@ -32,6 +32,15 @@ This command searches for exploitation attempts in compressed files in folder `/
    sudo find /var/log/ -name "*.gz" -type f -exec sh -c "zcat {} | sed -e 's/\${lower://'g | tr -d '}' | egrep -i 'jndi:(ldap[s]?|rmi|dns):'" \;
    ```

    ## Find Vulnerable Software (Windows)

    ```powershell
    gci 'C:\' -rec -force -include *.jar -ea 0 | foreach {select-string "JndiLookup.class" $_} | select -exp Path
    ```

    by [@CyberRaiju](https://twitter.com/CyberRaiju/status/1469505677580124160)


    ## YARA

    Preliminary YARA rules (work in progress)
  11. Neo23x0 revised this gist Dec 11, 2021. 1 changed file with 2 additions and 2 deletions.
    4 changes: 2 additions & 2 deletions log4j_rce_detection.md
    View file
    Original file line number Diff line number Diff line change
    @@ -23,13 +23,13 @@ These commands cover even the obfuscated variants but lack the file name in a ma
    This command searches for exploitation attempts in uncompressed files in folder `/var/log` and all sub folders

    ```bash
    sudo find /var/log/ -type f -exec sh -c "cat {} | sed -e 's/\${lower://'g | tr -d '}' | egrep -i 'jndi:(ldap[s]?|rmi|dns):'"\;
    sudo find /var/log/ -type f -exec sh -c "cat {} | sed -e 's/\${lower://'g | tr -d '}' | egrep -i 'jndi:(ldap[s]?|rmi|dns):'" \;
    ```

    This command searches for exploitation attempts in compressed files in folder `/var/log` and all sub folders

    ```bash
    sudo find /var/log/ -name "*.gz" -type f -exec sh -c "zcat {} | sed -e 's/\${lower://'g | tr -d '}' | egrep -i 'jndi:(ldap[s]?|rmi|dns):'" \;
    sudo find /var/log/ -name "*.gz" -type f -exec sh -c "zcat {} | sed -e 's/\${lower://'g | tr -d '}' | egrep -i 'jndi:(ldap[s]?|rmi|dns):'" \;
    ```

    ## YARA
  12. Neo23x0 revised this gist Dec 11, 2021. 1 changed file with 2 additions and 2 deletions.
    4 changes: 2 additions & 2 deletions log4j_rce_detection.md
    View file
    Original file line number Diff line number Diff line change
    @@ -23,13 +23,13 @@ These commands cover even the obfuscated variants but lack the file name in a ma
    This command searches for exploitation attempts in uncompressed files in folder `/var/log` and all sub folders

    ```bash
    sudo find /var/log/test/ -type f -exec sh -c "cat {} | sed -e 's/\${lower://'g | tr -d '}' | egrep -i 'jndi:(ldap[s]?|rmi|dns):'"\;
    sudo find /var/log/ -type f -exec sh -c "cat {} | sed -e 's/\${lower://'g | tr -d '}' | egrep -i 'jndi:(ldap[s]?|rmi|dns):'"\;
    ```

    This command searches for exploitation attempts in compressed files in folder `/var/log` and all sub folders

    ```bash
    sudo find /var/log/test/ -name "*.gz" -type f -exec sh -c "zcat {} | sed -e 's/\${lower://'g | tr -d '}' | egrep -i 'jndi:(ldap[s]?|rmi|dns):'" \;
    sudo find /var/log/ -name "*.gz" -type f -exec sh -c "zcat {} | sed -e 's/\${lower://'g | tr -d '}' | egrep -i 'jndi:(ldap[s]?|rmi|dns):'" \;
    ```

    ## YARA
  13. Neo23x0 revised this gist Dec 10, 2021. 1 changed file with 16 additions and 0 deletions.
    16 changes: 16 additions & 0 deletions log4j_rce_detection.md
    View file
    Original file line number Diff line number Diff line change
    @@ -6,6 +6,22 @@ You can use these commands and rules to search for exploitation attempts against

    This command searches for exploitation attempts in uncompressed files in folder `/var/log` and all sub folders

    ```bash
    sudo egrep -i -r '\$\{jndi:(ldap[s]?|rmi|dns):/[^\n]+' /var/log
    ```

    This command searches for exploitation attempts in compressed files in folder `/var/log` and all sub folders

    ```bash
    sudo find /var/log -name \*.gz -print0 | xargs -0 zgrep -E -i '\$\{jndi:(ldap[s]?|rmi|dns):/[^\n]+'
    ```

    ## Grep / Zgrep - Obfuscated Variants

    These commands cover even the obfuscated variants but lack the file name in a match.

    This command searches for exploitation attempts in uncompressed files in folder `/var/log` and all sub folders

    ```bash
    sudo find /var/log/test/ -type f -exec sh -c "cat {} | sed -e 's/\${lower://'g | tr -d '}' | egrep -i 'jndi:(ldap[s]?|rmi|dns):'"\;
    ```
  14. Neo23x0 revised this gist Dec 10, 2021. 1 changed file with 1 addition and 2 deletions.
    3 changes: 1 addition & 2 deletions log4j_rce_detection.md
    View file
    Original file line number Diff line number Diff line change
    @@ -13,8 +13,7 @@ sudo find /var/log/test/ -type f -exec sh -c "cat {} | sed -e 's/\${lower://'g |
    This command searches for exploitation attempts in compressed files in folder `/var/log` and all sub folders

    ```bash
    sudo find /var/log/test/ -name "*.gz" -type f -exec sh -c "zcat {} | sed -e 's/\${lower://'g | tr -d '}' | egrep -i 'jndi:(ld
    ap[s]?|rmi|dns):'" \;
    sudo find /var/log/test/ -name "*.gz" -type f -exec sh -c "zcat {} | sed -e 's/\${lower://'g | tr -d '}' | egrep -i 'jndi:(ldap[s]?|rmi|dns):'" \;
    ```

    ## YARA
  15. Neo23x0 revised this gist Dec 10, 2021. 1 changed file with 2 additions and 1 deletion.
    3 changes: 2 additions & 1 deletion log4j_rce_detection.md
    View file
    Original file line number Diff line number Diff line change
    @@ -13,7 +13,8 @@ sudo find /var/log/test/ -type f -exec sh -c "cat {} | sed -e 's/\${lower://'g |
    This command searches for exploitation attempts in compressed files in folder `/var/log` and all sub folders

    ```bash
    sudo find /var/log -name \*.gz -print0 | xargs -0 zgrep -E -i '\$\{jndi:(ldap[s]?|rmi|dns):/[^\n]+'
    sudo find /var/log/test/ -name "*.gz" -type f -exec sh -c "zcat {} | sed -e 's/\${lower://'g | tr -d '}' | egrep -i 'jndi:(ld
    ap[s]?|rmi|dns):'" \;
    ```

    ## YARA
  16. Neo23x0 revised this gist Dec 10, 2021. 1 changed file with 1 addition and 2 deletions.
    3 changes: 1 addition & 2 deletions log4j_rce_detection.md
    View file
    Original file line number Diff line number Diff line change
    @@ -7,8 +7,7 @@ You can use these commands and rules to search for exploitation attempts against
    This command searches for exploitation attempts in uncompressed files in folder `/var/log` and all sub folders

    ```bash
    sudo find /var/log/test/ -type f -exec sh -c "cat {} | sed -e 's/\${lower://'g | tr -d '}' | egrep -i 'jndi:(ldap[s]?|rmi|dns):'"
    \;
    sudo find /var/log/test/ -type f -exec sh -c "cat {} | sed -e 's/\${lower://'g | tr -d '}' | egrep -i 'jndi:(ldap[s]?|rmi|dns):'"\;
    ```

    This command searches for exploitation attempts in compressed files in folder `/var/log` and all sub folders
  17. Neo23x0 revised this gist Dec 10, 2021. 1 changed file with 2 additions and 1 deletion.
    3 changes: 2 additions & 1 deletion log4j_rce_detection.md
    View file
    Original file line number Diff line number Diff line change
    @@ -7,7 +7,8 @@ You can use these commands and rules to search for exploitation attempts against
    This command searches for exploitation attempts in uncompressed files in folder `/var/log` and all sub folders

    ```bash
    sudo egrep -i -r '\$\{jndi:(ldap[s]?|rmi|dns):/[^\n]+' /var/log
    sudo find /var/log/test/ -type f -exec sh -c "cat {} | sed -e 's/\${lower://'g | tr -d '}' | egrep -i 'jndi:(ldap[s]?|rmi|dns):'"
    \;
    ```

    This command searches for exploitation attempts in compressed files in folder `/var/log` and all sub folders
  18. Neo23x0 revised this gist Dec 10, 2021. No changes.
  19. Neo23x0 revised this gist Dec 10, 2021. 1 changed file with 1 addition and 0 deletions.
    1 change: 1 addition & 0 deletions log4j_rce_detection.md
    View file
    Original file line number Diff line number Diff line change
    @@ -82,3 +82,4 @@ I got help and ideas from

    - [@matthias_kaiser](https://twitter.com/matthias_kaiser)
    - [@daphiel](https://twitter.com/daphiel)
    - [@Reelix](https://twitter.com/Reelix)
  20. Neo23x0 revised this gist Dec 10, 2021. 1 changed file with 21 additions and 0 deletions.
    21 changes: 21 additions & 0 deletions log4j_rce_detection.md
    View file
    Original file line number Diff line number Diff line change
    @@ -49,6 +49,27 @@ rule EXPL_Log4j_CVE_2021_44228_Dec21_Hard {
    condition:
    $x1 and not 1 of ($fp*)
    }
    rule SUSP_Base64_Encoded_Exploit_Indicators_Dec21 {
    meta:
    description = "Detects base64 encoded strings found in payloads of exploits against log4j CVE-2021-44228"
    author = "Florian Roth"
    reference = "https://twitter.com/Reelix/status/1469327487243071493"
    date = "2021-12-10"
    score = 70
    strings:
    /* curl -s */
    $sa1 = "Y3VybCAtcy"
    $sa2 = "N1cmwgLXMg"
    $sa3 = "jdXJsIC1zI"
    /* |wget -q -O- */
    $sb1 = "fHdnZXQgLXEgLU8tI"
    $sb2 = "x3Z2V0IC1xIC1PLS"
    $sb3 = "8d2dldCAtcSAtTy0g"
    condition:
    1 of ($sa*) and 1 of ($sb*)
    }
    ```

    ## Help
  21. Neo23x0 revised this gist Dec 10, 2021. 1 changed file with 1 addition and 3 deletions.
    4 changes: 1 addition & 3 deletions log4j_rce_detection.md
    View file
    Original file line number Diff line number Diff line change
    @@ -20,7 +20,6 @@ sudo find /var/log -name \*.gz -print0 | xargs -0 zgrep -E -i '\$\{jndi:(ldap[s]

    Preliminary YARA rules (work in progress)
    ```yara
    rule EXPL_Log4j_CVE_2021_44228_Dec21_Soft {
    meta:
    description = "Detects indicators in server logs that indicate an exploitation attempt of CVE-2021-44228"
    @@ -45,12 +44,11 @@ rule EXPL_Log4j_CVE_2021_44228_Dec21_Hard {
    date = "2021-12-10"
    score = 80
    strings:
    $x1 = /\$\{jndi:(ldap|ldaps|rmi|dns):\/[\/]?[a-z-\.0-9]{3,42}:[0-9]{2,5}\/[a-zA-Z\.]{1,32}\}/
    $x1 = /\$\{jndi:(ldap|ldaps|rmi|dns):\/[\/]?[a-z-\.0-9]{3,120}:[0-9]{2,5}\/[a-zA-Z\.]{1,32}\}/
    $fp1r = /(ldap|rmi|ldaps|dns):\/[\/]?(127\.0\.0\.1|192\.168\.|172\.[1-3][0-9]\.|10\.)/
    condition:
    $x1 and not 1 of ($fp*)
    }
    ```

    ## Help
  22. Neo23x0 revised this gist Dec 10, 2021. 1 changed file with 10 additions and 7 deletions.
    17 changes: 10 additions & 7 deletions log4j_rce_detection.md
    View file
    Original file line number Diff line number Diff line change
    @@ -7,19 +7,20 @@ You can use these commands and rules to search for exploitation attempts against
    This command searches for exploitation attempts in uncompressed files in folder `/var/log` and all sub folders

    ```bash
    sudo egrep -i -r '\$\{jndi:(ldap[s]?|rmi)://[^\n]+' /var/log
    sudo egrep -i -r '\$\{jndi:(ldap[s]?|rmi|dns):/[^\n]+' /var/log
    ```

    This command searches for exploitation attempts in compressed files in folder `/var/log` and all sub folders

    ```bash
    sudo find /var/log -name \*.gz -print0 | xargs -0 zgrep -E -i '\$\{jndi:(ldap[s]?|rmi)://[^\n]+'
    sudo find /var/log -name \*.gz -print0 | xargs -0 zgrep -E -i '\$\{jndi:(ldap[s]?|rmi|dns):/[^\n]+'
    ```

    ## YARA

    Preliminary YARA rules (work in progress)
    ```yara
    rule EXPL_Log4j_CVE_2021_44228_Dec21_Soft {
    meta:
    description = "Detects indicators in server logs that indicate an exploitation attempt of CVE-2021-44228"
    @@ -28,9 +29,10 @@ rule EXPL_Log4j_CVE_2021_44228_Dec21_Soft {
    date = "2021-12-10"
    score = 60
    strings:
    $x1 = "${jndi:ldap://"
    $x2 = "${jndi:rmi://"
    $x3 = "${jndi:ldaps://"
    $x1 = "${jndi:ldap:/"
    $x2 = "${jndi:rmi:/"
    $x3 = "${jndi:ldaps:/"
    $x4 = "${jndi:dns:/"
    condition:
    1 of them
    }
    @@ -43,11 +45,12 @@ rule EXPL_Log4j_CVE_2021_44228_Dec21_Hard {
    date = "2021-12-10"
    score = 80
    strings:
    $x1 = /\$\{jndi:(ldap|ldaps|rmi):\/\/[a-z-\.0-9]{3,42}:[0-9]{2,5}\/[a-zA-Z\.]{1,32}\}/
    $fp1r = /(ldap|rmi|ldaps):\/\/(127\.0\.0\.1|192\.168\.|172\.[1-3][0-9]\.|10\.)/
    $x1 = /\$\{jndi:(ldap|ldaps|rmi|dns):\/[\/]?[a-z-\.0-9]{3,42}:[0-9]{2,5}\/[a-zA-Z\.]{1,32}\}/
    $fp1r = /(ldap|rmi|ldaps|dns):\/[\/]?(127\.0\.0\.1|192\.168\.|172\.[1-3][0-9]\.|10\.)/
    condition:
    $x1 and not 1 of ($fp*)
    }
    ```

    ## Help
  23. Neo23x0 revised this gist Dec 10, 2021. 1 changed file with 1 addition and 1 deletion.
    2 changes: 1 addition & 1 deletion log4j_rce_detection.md
    View file
    Original file line number Diff line number Diff line change
    @@ -44,7 +44,7 @@ rule EXPL_Log4j_CVE_2021_44228_Dec21_Hard {
    score = 80
    strings:
    $x1 = /\$\{jndi:(ldap|ldaps|rmi):\/\/[a-z-\.0-9]{3,42}:[0-9]{2,5}\/[a-zA-Z\.]{1,32}\}/
    $fp1r = /(ldap|rmi|ldaps):\/\/(127\.0\.0\.1|192\.168\.|172\.[1-3][0-9]\.)/
    $fp1r = /(ldap|rmi|ldaps):\/\/(127\.0\.0\.1|192\.168\.|172\.[1-3][0-9]\.|10\.)/
    condition:
    $x1 and not 1 of ($fp*)
    }
  24. Neo23x0 revised this gist Dec 10, 2021. 1 changed file with 4 additions and 0 deletions.
    4 changes: 4 additions & 0 deletions log4j_rce_detection.md
    View file
    Original file line number Diff line number Diff line change
    @@ -50,6 +50,10 @@ rule EXPL_Log4j_CVE_2021_44228_Dec21_Hard {
    }
    ```

    ## Help

    Please report findings that are not covered by these detection attempts.

    ## Credits

    I got help and ideas from
  25. Neo23x0 revised this gist Dec 10, 2021. 1 changed file with 1 addition and 3 deletions.
    4 changes: 1 addition & 3 deletions log4j_rce_detection.md
    View file
    Original file line number Diff line number Diff line change
    @@ -44,9 +44,7 @@ rule EXPL_Log4j_CVE_2021_44228_Dec21_Hard {
    score = 80
    strings:
    $x1 = /\$\{jndi:(ldap|ldaps|rmi):\/\/[a-z-\.0-9]{3,42}:[0-9]{2,5}\/[a-zA-Z\.]{1,32}\}/
    $fp1 = "ldap://127.0.0.1"
    $fp2 = "ldaps://127.0.0.1"
    $fp3 = "rmi://127.0.0.1"
    $fp1r = /(ldap|rmi|ldaps):\/\/(127\.0\.0\.1|192\.168\.|172\.[1-3][0-9]\.)/
    condition:
    $x1 and not 1 of ($fp*)
    }
  26. Neo23x0 revised this gist Dec 10, 2021. 1 changed file with 1 addition and 1 deletion.
    2 changes: 1 addition & 1 deletion log4j_rce_detection.md
    View file
    Original file line number Diff line number Diff line change
    @@ -56,5 +56,5 @@ rule EXPL_Log4j_CVE_2021_44228_Dec21_Hard {

    I got help and ideas from

    - @matthias_kaiser
    - [@matthias_kaiser](https://twitter.com/matthias_kaiser)
    - [@daphiel](https://twitter.com/daphiel)
  27. Neo23x0 revised this gist Dec 10, 2021. 1 changed file with 1 addition and 1 deletion.
    2 changes: 1 addition & 1 deletion log4j_rce_detection.md
    View file
    Original file line number Diff line number Diff line change
    @@ -57,4 +57,4 @@ rule EXPL_Log4j_CVE_2021_44228_Dec21_Hard {
    I got help and ideas from

    - @matthias_kaiser
    - @daphiel
    - [@daphiel](https://twitter.com/daphiel)
  28. Neo23x0 revised this gist Dec 10, 2021. 1 changed file with 6 additions and 0 deletions.
    6 changes: 6 additions & 0 deletions log4j_rce_detection.md
    View file
    Original file line number Diff line number Diff line change
    @@ -52,3 +52,9 @@ rule EXPL_Log4j_CVE_2021_44228_Dec21_Hard {
    }
    ```

    ## Credits

    I got help and ideas from

    - @matthias_kaiser
    - @daphiel
  29. Neo23x0 revised this gist Dec 10, 2021. 1 changed file with 1 addition and 1 deletion.
    2 changes: 1 addition & 1 deletion log4j_rce_detection.md
    View file
    Original file line number Diff line number Diff line change
    @@ -1,4 +1,4 @@
    # log4j RCE Detection
    # log4j RCE Exploitation Detection

    You can use these commands and rules to search for exploitation attempts against log4j RCE vulnerability CVE-2021-44228

  30. Neo23x0 revised this gist Dec 10, 2021. 1 changed file with 9 additions and 2 deletions.
    11 changes: 9 additions & 2 deletions log4j_rce_detection.md
    View file
    Original file line number Diff line number Diff line change
    @@ -1,4 +1,8 @@
    You can use these commands to search for exploitation attempts against log4j RCE vulnerability CVE-2021-44228
    # log4j RCE Detection

    You can use these commands and rules to search for exploitation attempts against log4j RCE vulnerability CVE-2021-44228

    ## Grep / Zgrep

    This command searches for exploitation attempts in uncompressed files in folder `/var/log` and all sub folders

    @@ -12,6 +16,8 @@ This command searches for exploitation attempts in compressed files in folder `/
    sudo find /var/log -name \*.gz -print0 | xargs -0 zgrep -E -i '\$\{jndi:(ldap[s]?|rmi)://[^\n]+'
    ```

    ## YARA

    Preliminary YARA rules (work in progress)
    ```yara
    rule EXPL_Log4j_CVE_2021_44228_Dec21_Soft {
    @@ -44,4 +50,5 @@ rule EXPL_Log4j_CVE_2021_44228_Dec21_Hard {
    condition:
    $x1 and not 1 of ($fp*)
    }
    ```
    ```