{"id":11451,"date":"2021-12-12T12:15:03","date_gmt":"2021-12-12T11:15:03","guid":{"rendered":"https:\/\/www.nextron-systems.com\/?p=11451"},"modified":"2022-03-25T14:15:38","modified_gmt":"2022-03-25T13:15:38","slug":"log4shell-detection-with-thor","status":"publish","type":"post","link":"https:\/\/www.nextron-systems.com\/2021\/12\/12\/log4shell-detection-with-thor\/","title":{"rendered":"Log4Shell Detection with Nextron Rules"},"content":{"rendered":"

[et_pb_section fb_built=”1″ _builder_version=”4.14.2″ _module_preset=”default” global_colors_info=”{}”][et_pb_row _builder_version=”4.14.2″ _module_preset=”default” global_colors_info=”{}”][et_pb_column type=”4_4″ _builder_version=”4.14.2″ _module_preset=”default” global_colors_info=”{}”][et_pb_text _builder_version=”4.14.2″ _module_preset=”default” global_colors_info=”{}”]<\/p>\n

The Log4Shell vulnerability (CVE-2021-44228) in log4j is actively exploited in-the-wild and highly critical. This blog posts lists some important web resources and the signatures that detect exploitation attempts.<\/p>\n

[\/et_pb_text][\/et_pb_column][\/et_pb_row][et_pb_row column_structure=”1_3,1_3,1_3″ _builder_version=”4.14.2″ _module_preset=”default” global_colors_info=”{}”][et_pb_column type=”1_3″ _builder_version=”4.14.2″ _module_preset=”default” global_colors_info=”{}”][et_pb_blurb title=”Explanation of the Vulnerability” url=”https:\/\/www.lunasec.io\/docs\/blog\/log4j-zero-day\/” url_new_window=”on” image=”https:\/\/www.nextron-systems.com\/wp-content\/uploads\/2021\/12\/Screenshot-2021-12-12-at-12.12.53.png” _builder_version=”4.14.2″ _module_preset=”default” global_colors_info=”{}”]<\/p>\n

LunaSec reported first on the vulnerability.<\/p>\n

[\/et_pb_blurb][\/et_pb_column][et_pb_column type=”1_3″ _builder_version=”4.14.2″ _module_preset=”default” global_colors_info=”{}”][et_pb_blurb title=”Canary-based Vulnerability Detection” url=”https:\/\/twitter.com\/cyb3rops\/status\/1469405846010572816″ url_new_window=”on” image=”https:\/\/www.nextron-systems.com\/wp-content\/uploads\/2021\/12\/Screenshot-2021-12-12-at-11.45.25.png” _builder_version=”4.14.2″ _module_preset=”default” global_colors_info=”{}”]<\/p>\n

Use this method to detect vulnerable applications and services in your organisation.<\/p>\n

[\/et_pb_blurb][\/et_pb_column][et_pb_column type=”1_3″ _builder_version=”4.14.2″ _module_preset=”default” global_colors_info=”{}”][et_pb_blurb title=”Grep \/ ZGrep Detection Ideas” url=”https:\/\/gist.github.com\/Neo23x0\/e4c8b03ff8cdf1fa63b7d15db6e3860b” url_new_window=”on” image=”https:\/\/www.nextron-systems.com\/wp-content\/uploads\/2021\/12\/Screenshot-2021-12-12-at-11.53.40.png” _builder_version=”4.14.2″ _module_preset=”default” global_colors_info=”{}”]<\/p>\n

Different detection patterns and idea to detect exploitation attempts in log files using grep and zgrep.<\/p>\n

[\/et_pb_blurb][\/et_pb_column][\/et_pb_row][et_pb_row column_structure=”1_3,1_3,1_3″ _builder_version=”4.14.2″ _module_preset=”default” global_colors_info=”{}”][et_pb_column type=”1_3″ _builder_version=”4.14.2″ _module_preset=”default” global_colors_info=”{}”][et_pb_blurb title=”Log4Shell Detector Python Script” url=”https:\/\/github.com\/Neo23x0\/log4shell-detector” url_new_window=”on” image=”https:\/\/www.nextron-systems.com\/wp-content\/uploads\/2021\/12\/screen1.png” _builder_version=”4.14.2″ _module_preset=”default” global_colors_info=”{}”]<\/p>\n

A python script that can be used to detect even the most obfuscated versions of the malicious payload.\u00a0<\/p>\n

[\/et_pb_blurb][\/et_pb_column][et_pb_column type=”1_3″ _builder_version=”4.14.2″ _module_preset=”default” global_colors_info=”{}”][et_pb_blurb title=”List of Advisories by Vendors” url=”https:\/\/gist.github.com\/SwitHak\/b66db3a06c2955a9cb71a8718970c592″ url_new_window=”on” image=”https:\/\/www.nextron-systems.com\/wp-content\/uploads\/2021\/12\/Screenshot-2021-12-12-at-11.50.10.png” _builder_version=”4.14.2″ _module_preset=”default” global_colors_info=”{}”]<\/p>\n

Big collection of advisories and statements by different vendors that use JAVA and log4j.\u00a0<\/p>\n

[\/et_pb_blurb][\/et_pb_column][et_pb_column type=”1_3″ _builder_version=”4.14.2″ _module_preset=”default” global_colors_info=”{}”][et_pb_blurb title=”List of Vulnerable Software with PoCs” url=”https:\/\/github.com\/YfryTchsGD\/Log4jAttackSurface” url_new_window=”on” image=”https:\/\/www.nextron-systems.com\/wp-content\/uploads\/2021\/12\/Screenshot-2021-12-13-at-11.38.45.png” _builder_version=”4.14.2″ _module_preset=”default” global_colors_info=”{}”]<\/p>\n

Incomplete list of software products that have proven to be vulnerable.<\/p>\n

[\/et_pb_blurb][\/et_pb_column][\/et_pb_row][et_pb_row column_structure=”1_3,1_3,1_3″ _builder_version=”4.14.2″ _module_preset=”default” global_colors_info=”{}”][et_pb_column type=”1_3″ _builder_version=”4.14.2″ _module_preset=”default” global_colors_info=”{}”][et_pb_blurb title=”Log4Shell Vulnerability Scanner (Local Files)” url=”https:\/\/github.com\/hillu\/local-log4j-vuln-scanner” url_new_window=”on” image=”https:\/\/www.nextron-systems.com\/wp-content\/uploads\/2021\/12\/Screenshot-2021-12-12-at-17.16.33.png” _builder_version=”4.14.2″ _module_preset=”default” global_colors_info=”{}”]<\/p>\n

Scans the file system of application servers for vulnerable versions of the log4j module.<\/p>\n

[\/et_pb_blurb][\/et_pb_column][et_pb_column type=”1_3″ _builder_version=”4.14.2″ _module_preset=”default” global_colors_info=”{}”][et_pb_blurb title=”Fenrir Log4Shell Release” url=”https:\/\/github.com\/Neo23x0\/Fenrir\/releases” url_new_window=”on” image=”https:\/\/www.nextron-systems.com\/wp-content\/uploads\/2021\/12\/Screenshot-2021-12-13-at-13.29.51.png” _builder_version=”4.14.2″ _module_preset=”default” global_colors_info=”{}”]<\/p>\n

A bash based IOC scanner that can be used on any Linux\/Unix system to detect traces of the attack and vulnerable log4j versions.<\/p>\n

[\/et_pb_blurb][\/et_pb_column][et_pb_column type=”1_3″ _builder_version=”4.14.2″ _module_preset=”default” global_colors_info=”{}”][\/et_pb_column][\/et_pb_row][et_pb_row _builder_version=”4.14.2″ _module_preset=”default” global_colors_info=”{}”][et_pb_column type=”4_4″ _builder_version=”4.14.2″ _module_preset=”default” global_colors_info=”{}”][et_pb_text _builder_version=”4.14.2″ _module_preset=”default” hover_enabled=”0″ global_colors_info=”{}” sticky_enabled=”0″]<\/p>\n

Signatures Detecting Log4Shell Attacks<\/h1>\n

Check for matches with the following rules:<\/p>\n

Exploitation<\/h3>\n

YARA<\/p>\n