Analytics Story: Log4Shell CVE-2021-44228

Updated Date: 2026-05-13 ID: b4453928-5a98-11ec-afcd-8de10b48fc52 Author: Jose Hernandez Product: Splunk Enterprise Security

Description

Log4Shell or CVE-2021-44228 is a Remote Code Execution (RCE) vulnerability in the Apache Log4j library, a widely used and ubiquitous logging framework for Java. The vulnerability allows an attacker who can control log messages to execute arbitrary code loaded from attacker-controlled servers and we anticipate that most apps using the Log4j library will meet this condition.

Why it matters

In late November 2021, Chen Zhaojun of Alibaba identified a remote code execution vulnerability. Previous work was seen in a 2016 Blackhat talk by Alvaro Munoz and Oleksandr Mirosh called "A Journey from JNDI/LDAP Manipulation to Remote Code Execution Dream Land". Reported under the CVE ID : CVE-2021-44228, released to the public on December 10, 2021. The vulnerability is exploited through improper deserialization of user input passed into the framework. It permits remote code execution and it can allow an attacker to leak sensitive data, such as environment variables, or execute malicious software on the target system.

Correlation Search

Log4Shell CVE-2021-44228 Exploitation

1| tstats `security_content_summariesonly` min(_time) as firstTime max(_time) as lastTime sum(All_Risk.calculated_risk_score) as risk_score, count(All_Risk.calculated_risk_score) as risk_event_count, values(All_Risk.annotations.mitre_attack.mitre_tactic_id) as annotations.mitre_attack.mitre_tactic_id, dc(All_Risk.annotations.mitre_attack.mitre_tactic_id) as mitre_tactic_id_count, values(All_Risk.annotations.mitre_attack.mitre_technique_id) as annotations.mitre_attack.mitre_technique_id, dc(All_Risk.annotations.mitre_attack.mitre_technique_id) as mitre_technique_id_count, values(All_Risk.tag) as tag, values(source) as source, dc(source) as source_count FROM datamodel=Risk.All_Risk
2  WHERE All_Risk.analyticstories="Log4Shell CVE-2021-44228" All_Risk.risk_object_type="system"
3  BY All_Risk.risk_object All_Risk.risk_object_type All_Risk.annotations.mitre_attack.mitre_tactic
4| `drop_dm_object_name(All_Risk)`
5| `security_content_ctime(firstTime)`
6| `security_content_ctime(lastTime)`
7| where source_count >= 2
8| `log4shell_cve_2021_44228_exploitation_filter`

Detections

Name ▲▼	Technique ▲▼	Type ▲▼
Java Class File download by Java User Agent	Exploit Public-Facing Application	TTP
File Download or Read to Pipe Execution	Ingress Tool Transfer	TTP
Web or Application Server Spawning a Shell	External Remote Services, Exploit Public-Facing Application	TTP
Outbound Network Connection from Java Using Default Ports	External Remote Services, Exploit Public-Facing Application	TTP
Detect Outbound LDAP Traffic	Command and Scripting Interpreter, Exploit Public-Facing Application	Hunting
Hunting for Log4Shell	External Remote Services, Exploit Public-Facing Application	Hunting
CMD Carry Out String Command Parameter	Windows Command Shell	Hunting
Log4Shell JNDI Payload Injection Attempt	External Remote Services, Exploit Public-Facing Application	Anomaly
PowerShell - Connect To Internet With Hidden Window	PowerShell	Hunting
Log4Shell JNDI Payload Injection with Outbound Connection	External Remote Services, Exploit Public-Facing Application	Anomaly

Data Sources

Name ▲▼	Platform ▲▼	Sourcetype ▲▼	Source ▲▼
Splunk Stream HTTP	Splunk	`stream:http`	`stream:http`
CrowdStrike ProcessRollup2	Other	`crowdstrike:events:sensor`	`crowdstrike`
Sysmon for Linux EventID 1	Linux	`sysmon:linux`	`Syslog:Linux-Sysmon/Operational`
Sysmon EventID 1	Windows	`XmlWinEventLog`	`XmlWinEventLog:Microsoft-Windows-Sysmon/Operational`
Windows Event Log Security 4688	Windows	`XmlWinEventLog`	`XmlWinEventLog:Security`
Sysmon EventID 3	Windows	`XmlWinEventLog`	`XmlWinEventLog:Microsoft-Windows-Sysmon/Operational`
Palo Alto Network Traffic	Network	`pan:traffic`	`not_applicable`
Cisco Secure Access Firewall	Other	`cisco:cloud_security:firewall`	`cisco_secure_access:firewall`
Cisco Secure Firewall Threat Defense Connection Event	Other	`cisco:sfw:estreamer`	`not_applicable`
Nginx Access	Other	`nginx:plus:kv`	`/var/log/nginx/access.log`

References

Source: GitHub | Version: 2