mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
fixing yaml error
This commit is contained in:
@@ -10,7 +10,7 @@ description:
|
||||
This correlation find exploitation of Log4Shell CVE-2021-44228 against systems using detections from Splunk Security Content Analytic Story.
|
||||
It does this by calculating the distinct count of MITRE ATT&CK tactics from Log4Shell detections fired.
|
||||
If the count is larger than 2 or more distinct MITRE ATT&CK tactics we assume high problability of exploitation.
|
||||
The Analytic story breaks down into 3 major phases of a Log4Shell exploitation, specifically:
|
||||
The Analytic story breaks down into 3 major phases of a Log4Shell exploitation, specifically
|
||||
1. Initial Payload delivery eg. `${jndi:ldap://PAYLOAD_INJECTED}`
|
||||
2. Call back to malicious LDAP server eg. Exploit.class
|
||||
3. Post Exploitation Activity/Lateral Movement using Powershell or similar T1562.001
|
||||
|
||||
Reference in New Issue
Block a user