Neo23x0

log4j RCE Exploitation Detection

You can use these commands and rules to search for exploitation attempts against log4j RCE vulnerability CVE-2021-44228

Grep / Zgrep

This command searches for exploitation attempts in uncompressed files in folder /var/log and all sub folders

sudo egrep -I -i -r '\$(\{|%7B)jndi:(ldap[s]?|rmi|dns|nis|iiop|corba|nds|http):/[^\n]+' /var/log

twencl

#!/bin/sh

echo "What should the Application be called (no spaces allowed e.g. GCal)?"
read inputline
name="$inputline"

echo "What is the url (e.g. https://www.google.com/calendar/render)?"
read inputline
url="$inputline"