From a9edbc20bd85eeddb0ddd06afbaf3fab4adcbd48 Mon Sep 17 00:00:00 2001
From: P4T12ICK <pbareiss@splunk.com>
Date: Tue, 14 Dec 2021 17:49:26 +0100
Subject: [PATCH] log4j

---
 ...ell_jndi_payload_injection_with_outbound_connection.yml | 7 ++-----
 1 file changed, 2 insertions(+), 5 deletions(-)

diff --git a/detections/web/log4shell_jndi_payload_injection_with_outbound_connection.yml b/detections/web/log4shell_jndi_payload_injection_with_outbound_connection.yml
index 2d1e653656..1ba011a3b7 100644
--- a/detections/web/log4shell_jndi_payload_injection_with_outbound_connection.yml
+++ b/detections/web/log4shell_jndi_payload_injection_with_outbound_connection.yml
@@ -7,17 +7,14 @@ type: Anomaly
 datamodel:
 - Network_Traffic
 - Web
-description: UPDATE_DESCRIPTION
-	WHAT IS THIS?
-	WHAT DOES IT LOOK LIKE?
-	HOW DO YOU TRIAGE IT?
+description: description
 search: '| from datamodel Web.Web | rex field=_raw max_match=0 "[jJnNdDiI]{4}(\:|\%3A|\/|\%2F)(?<proto>\w+)(\:\/\/|\%3A\%2F\%2F)(\$\{.*?\}(\.)?)?(?<affected_host>[a-zA-Z0-9\.\-\_\$]+)" | join affected_host type=inner [| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Network_Traffic.All_Traffic by All_Traffic.dest | `drop_dm_object_name(All_Traffic)`
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | rename dest AS affected_host] | `log4shell_jndi_payload_injection_with_outbound_connection_filter`'
 how_to_implement: UPDATE_HOW_TO_IMPLEMENT
 known_false_positives: UPDATE_KNOWN_FALSE_POSITIVES
 references:
--  todo
+- todo
 tags:
   analytic_story:
   - UPDATE_STORY_NAME