admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Added detection testing service results inLog4Shell JNDI Payload Injection Attempt

Browse Source
This commit is contained in:
root
2021-12-14 17:42:22 +00:00
parent 3f59f79b93
commit f03ab2f721
1 changed files with 26 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/web/log4shell_jndi_payload_injection_attempt.yml
+26 -11
View File
@@ -6,16 +6,31 @@ author: Jose Hernandez
type: Anomaly
datamodel:
- Web
description: CVE-2021-44228 Log4Shell payloads can be injected via various methods, but on of the most common vectors injection is via Web calls. Many of the vulnerable java web applications that are using log4j have a web component to them are specially targets of this injection, specifically projects like Apache Struts, Flink, Druid, and Solr.
The exploit is triggered by a LDAP lookup function in the log4j package, its invocation is similar to `${jndi:ldap://PAYLOAD_INJECTED}`, when executed against vulnerable web applications the invocation can be seen in various part of web logs. Specifically it has been successfully exploited via headers like X-Forwarded-For, User-Agent, Referer, and X-Api-Version.
In this detection we first limit the scope of our search to the Web Datamodel and use the `| from datamodel` function to benefit from schema accelerated searching capabilities, mainly because the second part of the detection is pretty heavy, it runs a regex across all _raw events that looks for `${jndi:ldap://` pattern across all potential web fields available to the raw data, like http headers for example.
If you see results for this detection, it means that there was a attempt at a injection, which could be a reconnaissance activity or a valid expliotation attempt, but this does not exactly mean that the host was indeed successfully exploited.
description: CVE-2021-44228 Log4Shell payloads can be injected via various methods,
but on of the most common vectors injection is via Web calls. Many of the vulnerable
java web applications that are using log4j have a web component to them are specially
targets of this injection, specifically projects like Apache Struts, Flink, Druid,
and Solr. The exploit is triggered by a LDAP lookup function in the log4j package,
its invocation is similar to `${jndi:ldap://PAYLOAD_INJECTED}`, when executed against
vulnerable web applications the invocation can be seen in various part of web logs.
Specifically it has been successfully exploited via headers like X-Forwarded-For,
User-Agent, Referer, and X-Api-Version. In this detection we first limit the scope
of our search to the Web Datamodel and use the `| from datamodel` function to benefit
from schema accelerated searching capabilities, mainly because the second part of
the detection is pretty heavy, it runs a regex across all _raw events that looks
for `${jndi:ldap://` pattern across all potential web fields available to the raw
data, like http headers for example. If you see results for this detection, it means
that there was a attempt at a injection, which could be a reconnaissance activity
or a valid expliotation attempt, but this does not exactly mean that the host was
indeed successfully exploited.
search: '| from datamodel Web.Web | regex _raw="[jJnNdDiI]{4}(\:|\%3A|\/|\%2F)\w+(\:\/\/|\%3A\%2F\%2F)(\$\{.*?\}(\.)?)?"
| fillnull
| stats count by action, category, dest, dest_port, http_content_type, http_method, http_referrer, http_user_agent, site, src, url, url_domain, user
| `log4shell_jndi_payload_injection_attempt_filter`'
how_to_implement: This detection requires the Web datamodel to be populated from a supported Technology Add-On like Splunk for Apache or Splunk for Nginx.
known_false_positives: If there is a vulnerablility scannner looking for log4shells this will trigger, otherwise likely to have low false positives.
| fillnull | stats count by action, category, dest, dest_port, http_content_type,
http_method, http_referrer, http_user_agent, site, src, url, url_domain, user |
`log4shell_jndi_payload_injection_attempt_filter`'
how_to_implement: This detection requires the Web datamodel to be populated from a
supported Technology Add-On like Splunk for Apache or Splunk for Nginx.
known_false_positives: If there is a vulnerablility scannner looking for log4shells
this will trigger, otherwise likely to have low false positives.
references:
- https://www.lunasec.io/docs/blog/log4j-zero-day/
tags:
@@ -49,9 +64,8 @@ tags:
security_domain: threat
impact: 50
confidence: 30
# (impact * confidence)/100
risk_score: 15
context:
context: null
message: CVE-2021-44228 Log4Shell triggered for host $dest$
observable:
- name: user
@@ -70,3 +84,4 @@ tags:
- CIS 16
cve:
- CVE-2021-44228
automated_detection_testing: passed