admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

log4j

Browse Source
This commit is contained in:
P4T12ICK
2021-12-14 17:49:26 +01:00
parent 45cd729295
commit a9edbc20bd
1 changed files with 2 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/web/log4shell_jndi_payload_injection_with_outbound_connection.yml
+2 -5
View File
@@ -7,17 +7,14 @@ type: Anomaly
datamodel:
- Network_Traffic
- Web
description: UPDATE_DESCRIPTION
WHAT IS THIS?
WHAT DOES IT LOOK LIKE?
HOW DO YOU TRIAGE IT?
description: description
search: '| from datamodel Web.Web | rex field=_raw max_match=0 "[jJnNdDiI]{4}(\:|\%3A|\/|\%2F)(?<proto>\w+)(\:\/\/|\%3A\%2F\%2F)(\$\{.*?\}(\.)?)?(?<affected_host>[a-zA-Z0-9\.\-\_\$]+)" | join affected_host type=inner [| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime from datamodel=Network_Traffic.All_Traffic by All_Traffic.dest | `drop_dm_object_name(All_Traffic)`
| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | rename dest AS affected_host] | `log4shell_jndi_payload_injection_with_outbound_connection_filter`'
how_to_implement: UPDATE_HOW_TO_IMPLEMENT
known_false_positives: UPDATE_KNOWN_FALSE_POSITIVES
references:
- todo
- todo
tags:
analytic_story:
- UPDATE_STORY_NAME