cscli scenarios install crowdsecurity/apache_log4j2_cve-2021-44228Scenario to detect exploitation attempts of "log4j" CVE-2021-44228.
⚠️ Crowdsec is not a WAF and, as such, bypass to those signatures are likely ⚠️
1type: trigger2format: 2.03#debug: true4name: crowdsecurity/apache_log4j2_cve-2021-442285description: "Detect cve-2021-44228 exploitation attempts"6filter: |7 evt.Meta.log_type in ["http_access-log", "http_error-log"] and8 (9 any(File("log4j2_cve_2021_44228.txt"), { Upper(evt.Meta.http_path) contains Upper(#)})10 or11 any(File("log4j2_cve_2021_44228.txt"), { Upper(evt.Parsed.http_user_agent) contains Upper(#)})12 or13 any(File("log4j2_cve_2021_44228.txt"), { Upper(evt.Parsed.http_referer) contains Upper(#)})14 )15data:16 - source_url: https://hub-data.crowdsec.net/web/log4j2_cve_2021_44228.txt17 dest_file: log4j2_cve_2021_44228.txt18 type: string19groupby: "evt.Meta.source_ip"20blackhole: 2m21labels:22 service: apache23 confidence: 324 spoofable: 025 classification:26 - attack.T159527 - attack.T119028 - cve.CVE-2021-4422829 behavior: "http:exploit"30 label: "Log4j CVE-2021-44228"31 remediation: true32