Try in Splunk Security Cloud

Description

A required step while exploiting the CVE-2021-44228-Log4j vulnerability is that the victim server will perform outbound connections to attacker-controlled infrastructure. This is required as part of the JNDI lookup as well as for retrieving the second stage .class payload. The following analytic identifies the Java process reaching out to default ports used by the LDAP and RMI protocols. This behavior could represent successfull exploitation. Note that adversaries can easily decide to use arbitrary ports for these protocols and potentially bypass this detection.

  • Type: TTP
  • Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
  • Datamodel:
  • Last Updated: 2021-12-13
  • Author: Mauricio Velazco, Splunk
  • ID: d2c14d28-5c47-11ec-9892-acde48001122

ATT&CK

ID Technique Tactic
T1190 Exploit Public-Facing Application Initial Access

| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes where (Processes.process_name="java.exe" OR Processes.process_name=javaw.exe OR Processes.process_name=javaw.exe) by _time Processes.process_guid Processes.process_name Processes.dest Processes.process_path Processes.process Processes.parent_process_name 
|  `drop_dm_object_name(Processes)` 
| `security_content_ctime(firstTime)` 
| `security_content_ctime(lastTime)` 
| join  process_guid [
| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Ports where (Ports.dest_port= 389 OR Ports.dest_port= 636 OR Ports.dest_port = 1389 OR Ports.dest_port = 1099 ) by Ports.process_guid Ports.dest Ports.dest_port
| `drop_dm_object_name(Ports)` 
|  rename  dest as connection_to_CNC] 
| table _time dest parent_process_name process_name process_path process connection_to_CNC dest_port 
| `outbound_network_connection_from_java_using_default_ports_filter`

Associated Analytic Story

How To Implement

To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the Endpoint datamodel in the Processes node.

Required field

  • _time
  • Processes.process_guid
  • Processes.process_name
  • Processes.dest
  • Processes.process_path
  • Processes.process
  • Processes.parent_process_name
  • Ports.process_guid
  • Ports.dest
  • Ports.dest_port

Kill Chain Phase

  • Exploitation

Known False Positives

Legitimate Java applications may use perform outbound connections to these ports. Filter as needed

RBA

Risk Score Impact Confidence Message
54.0 90 60 Java performed outbound connections to default ports of LDAP or RMI on $dest$

CVE

ID Summary CVSS
CVE-2021-44228 Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0 (along with 2.12.2, 2.12.3, and 2.3.1), this functionality has been completely removed. Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects. 9.3

Reference

Test Dataset

Replay any dataset to Splunk Enterprise by using our replay.py tool or the UI. Alternatively you can replay a dataset into a Splunk Attack Range

source | version: 1