Log4j CVE-2021-44228 Detection Scenario by crowdsecurity | CrowdSec Hub

Log4j CVE-2021-44228

Attack scenariohttp:exploitMITRE T1595MITRE T1190cve.CVE-2021-44228

By: crowdsecurity
Version: 0.7
Name: crowdsecurity/apache_log4j2_cve-2021-44228
Remediation: Ban

Detect cve-2021-44228 exploitation attempts

Install with a top-level collection

16 collections include it

sudo cscli collections install crowdsecurity/whm

Installs 18 parsers and 66 scenarios, via HTTP - CVE Detection.

View WHM →

Installation

sudo cscli scenarios install crowdsecurity/apache_log4j2_cve-2021-44228

Then reload CrowdSec: sudo systemctl reload crowdsec

Configuration

Hover a line or a note to see what each field does.

scenarios/crowdsecurity/apache_log4j2_cve-2021-44228.yaml· 31 linesGitHub

1type: trigger1
2format: 2.0
3#debug: true
4name: crowdsecurity/apache_log4j2_cve-2021-44228
5description: "Detect cve-2021-44228 exploitation attempts"
6filter: |2
7  evt.Meta.log_type in ["http_access-log", "http_error-log"] and 
8  (
9    any(File("log4j2_cve_2021_44228.txt"), { Upper(evt.Meta.http_path) contains Upper(#)})
10  or
11    any(File("log4j2_cve_2021_44228.txt"), { Upper(evt.Parsed.http_user_agent) contains Upper(#)})
12  or
13    any(File("log4j2_cve_2021_44228.txt"), { Upper(evt.Parsed.http_referer) contains Upper(#)})  
14  )
15data:
16  - source_url: https://hub-data.crowdsec.net/web/log4j2_cve_2021_44228.txt
17    dest_file: log4j2_cve_2021_44228.txt
18    type: string
19groupby: "evt.Meta.source_ip"3
20blackhole: 2m4
21labels:
22  service: apache
23  confidence: 3
24  spoofable: 0
25  classification:5
26    - attack.T1595
27    - attack.T1190
28    - cve.CVE-2021-44228
29  behavior: "http:exploit"
30  label: "Log4j CVE-2021-44228"
31  remediation: true6

Installed on

Know where it runs

Sign in to see the Security Engines that run this attack scenario, the version they run and whether it was modified locally.

Documentation

Scenario to detect exploitation attempts of "log4j" CVE-2021-44228.

⚠️ Crowdsec is not a WAF and, as such, bypass to those signatures are likely ⚠️