fixing yaml error

This commit is contained in:
d1vious
2022-01-27 15:05:08 -05:00
parent 8fb6b17139
commit 39cb6376b4
@@ -10,7 +10,7 @@ description:
This correlation find exploitation of Log4Shell CVE-2021-44228 against systems using detections from Splunk Security Content Analytic Story.
It does this by calculating the distinct count of MITRE ATT&CK tactics from Log4Shell detections fired.
If the count is larger than 2 or more distinct MITRE ATT&CK tactics we assume high problability of exploitation.
The Analytic story breaks down into 3 major phases of a Log4Shell exploitation, specifically:
The Analytic story breaks down into 3 major phases of a Log4Shell exploitation, specifically
1. Initial Payload delivery eg. `${jndi:ldap://PAYLOAD_INJECTED}`
2. Call back to malicious LDAP server eg. Exploit.class
3. Post Exploitation Activity/Lateral Movement using Powershell or similar T1562.001