From 39cb6376b41573be3ccad883e78cf63258167daf Mon Sep 17 00:00:00 2001 From: d1vious Date: Thu, 27 Jan 2022 15:05:08 -0500 Subject: [PATCH] fixing yaml error --- detections/endpoint/log4shell_cve_2021_44228_exploitation_.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/log4shell_cve_2021_44228_exploitation_.yml b/detections/endpoint/log4shell_cve_2021_44228_exploitation_.yml index 45a37df74e..106e7f4d9e 100644 --- a/detections/endpoint/log4shell_cve_2021_44228_exploitation_.yml +++ b/detections/endpoint/log4shell_cve_2021_44228_exploitation_.yml @@ -10,7 +10,7 @@ description: This correlation find exploitation of Log4Shell CVE-2021-44228 against systems using detections from Splunk Security Content Analytic Story. It does this by calculating the distinct count of MITRE ATT&CK tactics from Log4Shell detections fired. If the count is larger than 2 or more distinct MITRE ATT&CK tactics we assume high problability of exploitation. - The Analytic story breaks down into 3 major phases of a Log4Shell exploitation, specifically: + The Analytic story breaks down into 3 major phases of a Log4Shell exploitation, specifically 1. Initial Payload delivery eg. `${jndi:ldap://PAYLOAD_INJECTED}` 2. Call back to malicious LDAP server eg. Exploit.class 3. Post Exploitation Activity/Lateral Movement using Powershell or similar T1562.001