mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
ljstella
34 lines
2.4 KiB
YAML
34 lines
2.4 KiB
YAML
name: Log4j Respond
|
|
id: e609d729-4076-421a-b8f7-9e545d000381
|
|
version: 2
|
|
creation_date: '2021-12-15'
|
|
modification_date: '2026-05-19'
|
|
author: Philip Royer, Splunk
|
|
type: Response
|
|
description: Published in response to CVE-2021-44228, this playbook is meant to be launched after log4j_investigate. In this playbook, the risk from exploited hosts can be mitigated by optionally deleting malicious files from the hosts, blocking outbound network connections from the hosts, and/or shutting down the hosts
|
|
playbook: log4j_respond
|
|
how_to_implement: To use this playbook, create a custom list called "log4j_hosts_and_files" with a format in which the first column should be an IP or hostname of a potentially affected log4j host, the second should be the operating system family (either unix or windows), and the third should be a full path to a file to delete if there are any. The first two are mandatory and the file is optional. In the block called "enumerate_files_to_delete", change the custom list name from "log4j_hosts_and_files" if needed. If ssh and/or winrm are not the preferred endpoint management methods, these playbooks could be ported to use Google's GRR, osquery, CrowdStrike's RTR, Carbon Black's EDR API, or similar tools. The artifact scope "all" is used throughout this playbook because the artifact list can be added to as the playbook progresses.
|
|
references:
|
|
- "https://github.com/Neo23x0/Fenrir/blob/master/fenrir.sh"
|
|
- "https://isc.sans.edu/diary/Log4j++Log4Shell+Followup%3A+What+we+see+and+how+to+defend+%28and+how+to+access+our+data%29/28122"
|
|
- "https://twitter.com/ElektroWolle/status/1469962895849140224?ref_src=twsrc%5Etfw%7Ctwcamp%5Etweetembed%7Ctwterm%5E1469962895849140224%7Ctwgr%5E%7Ctwcon%5Es1_c10&ref_url=https%3A%2F%2Fpublish.twitter.com%2F%3Fquery%3Dhttps3A2F2Ftwitter.com2FElektroWolle2Fstatus2F1469962895849140224widget%3DTweet"
|
|
- "https://blog.cloudflare.com/cve-2021-44228-log4j-rce-0-day-mitigation/"
|
|
app_list: []
|
|
platform_tags:
|
|
- Log4J
|
|
playbook_type: Automation
|
|
vpe_type: Modern
|
|
playbook_fields: []
|
|
product:
|
|
- Splunk SOAR
|
|
analytic_story:
|
|
- Log4Shell CVE-2021-44228
|
|
detections:
|
|
- File Download or Read to Pipe Execution
|
|
- Web or Application Server Spawning a Shell
|
|
- Java Class File download by Java User Agent
|
|
- Outbound Network Connection from Java Using Default Ports
|
|
- Log4Shell JNDI Payload Injection Attempt
|
|
- Log4Shell JNDI Payload Injection with Outbound Connection
|
|
- Detect Outbound LDAP Traffic
|