admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

fixing backslide

Browse Source
This commit is contained in:
Lou Stella
2021-12-14 19:41:19 -06:00
parent 2cd9e3940d
commit fafa45fcc9
1 changed files with 12 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
playbooks/log4j_investigate_and_respond.yml
+12
View File
@@ -22,6 +22,18 @@ app_list: []
tags:
platform_tags:
- Response
analytic_story:
- Log4Shell CVE-2021-44228
detections:
- Curl Download and Bash Execution
- Wget Download and Bash Execution
- Linux Java Spawning Shell
- Windows Java Spawning Shell
- Java Class File download by Java User Agent
- Outbound Network Connection from Java Using Default Ports
- Log4Shell JNDI Payload Injection Attempt
- Log4Shell JNDI Payload Injection with Outbound Connection
- Detect Outbound LDAP Traffic
playbook_fields: []
product:
- Splunk SOAR