From a4aaf03206ff041be6a9ff313665f9cd959cc5cf Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Tue, 14 Dec 2021 12:18:58 -0800 Subject: [PATCH] Update outbound_network_connection_from_java_using_default_ports.yml --- ...ound_network_connection_from_java_using_default_ports.yml | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/detections/endpoint/outbound_network_connection_from_java_using_default_ports.yml b/detections/endpoint/outbound_network_connection_from_java_using_default_ports.yml index 4c30dd09a2..22f2e44f70 100644 --- a/detections/endpoint/outbound_network_connection_from_java_using_default_ports.yml +++ b/detections/endpoint/outbound_network_connection_from_java_using_default_ports.yml @@ -4,11 +4,10 @@ version: 1 date: '2021-12-13' author: Mauricio Velazco, Splunk type: TTP -datamodel: -- Endpoint +datamodel: [] description: A required step while exploiting the CVE-2021-44228-Log4j vulnerability is that the victim server will perform outbound connections to attacker-controlled - infrastrucutre. This is required as part of the JNDI lookup as well as for retrieving + infrastructure. This is required as part of the JNDI lookup as well as for retrieving the second stage .class payload. The following analytic identifies the Java process reaching out to default ports used by the LDAP and RMI protocols. This behavior could represent successfull exploitation. Note that adversaries can easily decide to use