Log4j RCE CVE-2021-44228 in Fields

title: Log4j RCE CVE-2021-44228 in Fields
id: 9be472ed-893c-4ec0-94da-312d2765f654
status: test
description: Detects exploitation attempt against log4j RCE vulnerability reported as CVE-2021-44228 in different header fields found in web server logs (Log4Shell)
references:
    - https://web.archive.org/web/20231230220738/https://www.lunasec.io/docs/blog/log4j-zero-day/
    - https://news.ycombinator.com/item?id=29504755
    - https://github.com/tangxiaofeng7/apache-log4j-poc
    - https://gist.github.com/Neo23x0/e4c8b03ff8cdf1fa63b7d15db6e3860b
    - https://github.com/YfryTchsGD/Log4jAttackSurface
    - https://twitter.com/shutingrz/status/1469255861394866177?s=21
author: Florian Roth (Nextron Systems)
date: 2021-12-10
modified: 2023-01-02
tags:
    - attack.initial-access
    - attack.t1190
    - cve.2021-44228
    - detection.emerging-threats
logsource:
    category: webserver
detection:
    selection1:
        cs-user-agent|contains:
            - '${jndi:ldap:/'
            - '${jndi:rmi:/'
            - '${jndi:ldaps:/'
            - '${jndi:dns:/'
            - '/$%7bjndi:'
            - '%24%7bjndi:'
            - '$%7Bjndi:'
            - '%2524%257Bjndi'
            - '%2F%252524%25257Bjndi%3A'
            - '${jndi:${lower:'
            - '${::-j}${'
            - '${jndi:nis'
            - '${jndi:nds'
            - '${jndi:corba'
            - '${jndi:iiop'
            - 'Reference Class Name: foo'
            - '${${env:BARFOO:-j}'
            - '${::-l}${::-d}${::-a}${::-p}'
            - '${base64:JHtqbmRp'
            - '${${env:ENV_NAME:-j}ndi${env:ENV_NAME:-:}$'
            - '${${lower:j}ndi:'
            - '${${upper:j}ndi:'
            - '${${::-j}${::-n}${::-d}${::-i}:'
    # selection2:
        # user-agent|contains:
            # - '${jndi:ldap:/'
            # - '${jndi:rmi:/'
            # - '${jndi:ldaps:/'
            # - '${jndi:dns:/'
            # - '/$%7bjndi:'
            # - '%24%7bjndi:'
            # - '$%7Bjndi:'
            # - '%2524%257Bjndi'
            # - '%2F%252524%25257Bjndi%3A'
            # - '${jndi:${lower:'
            # - '${::-j}${'
            # - '${jndi:nis'
            # - '${jndi:nds'
            # - '${jndi:corba'
            # - '${jndi:iiop'
            # - 'Reference Class Name: foo'
            # - '${${env:BARFOO:-j}'
            # - '${::-l}${::-d}${::-a}${::-p}'
            # - '${base64:JHtqbmRp'
            # - '${${env:ENV_NAME:-j}ndi${env:ENV_NAME:-:}$'
            # - '${${lower:j}ndi:'
            # - '${${upper:j}ndi:'
            # - '${${::-j}${::-n}${::-d}${::-i}:'
    selection3:
        cs-uri-query|contains:
            - '${jndi:ldap:/'
            - '${jndi:rmi:/'
            - '${jndi:ldaps:/'
            - '${jndi:dns:/'
            - '/$%7bjndi:'
            - '%24%7bjndi:'
            - '$%7Bjndi:'
            - '%2524%257Bjndi'
            - '%2F%252524%25257Bjndi%3A'
            - '${jndi:${lower:'
            - '${::-j}${'
            - '${jndi:nis'
            - '${jndi:nds'
            - '${jndi:corba'
            - '${jndi:iiop'
            - 'Reference Class Name: foo'
            - '${${env:BARFOO:-j}'
            - '${::-l}${::-d}${::-a}${::-p}'
            - '${base64:JHtqbmRp'
            - '${${env:ENV_NAME:-j}ndi${env:ENV_NAME:-:}$'
            - '${${lower:j}ndi:'
            - '${${upper:j}ndi:'
            - '${${::-j}${::-n}${::-d}${::-i}:'
    selection4:
        cs-referer|contains:
            - '${jndi:ldap:/'
            - '${jndi:rmi:/'
            - '${jndi:ldaps:/'
            - '${jndi:dns:/'
            - '/$%7bjndi:'
            - '%24%7bjndi:'
            - '$%7Bjndi:'
            - '%2524%257Bjndi'
            - '%2F%252524%25257Bjndi%3A'
            - '${jndi:${lower:'
            - '${::-j}${'
            - '${jndi:nis'
            - '${jndi:nds'
            - '${jndi:corba'
            - '${jndi:iiop'
            - 'Reference Class Name: foo'
            - '${${env:BARFOO:-j}'
            - '${::-l}${::-d}${::-a}${::-p}'
            - '${base64:JHtqbmRp'
            - '${${env:ENV_NAME:-j}ndi${env:ENV_NAME:-:}$'
            - '${${lower:j}ndi:'
            - '${${upper:j}ndi:'
            - '${${::-j}${::-n}${::-d}${::-i}:'
    condition: 1 of selection*
falsepositives:
    - Vulnerability scanning
level: high