ID | Technique | Tactic |
---|---|---|
T1190 | Exploit Public-Facing Application | Initial Access |
T1133 | External Remote Services | Initial Access |
Detection: Log4Shell JNDI Payload Injection with Outbound Connection
Description
The following analytic detects Log4Shell JNDI payload injections via outbound connections. It identifies suspicious LDAP lookup functions in web logs, such as ${jndi:ldap://PAYLOAD_INJECTED}
, and correlates them with network traffic to known malicious IP addresses. This detection leverages the Web and Network_Traffic data models in Splunk. Monitoring this activity is crucial as it targets vulnerabilities in Java web applications using log4j, potentially leading to remote code execution. If confirmed malicious, attackers could gain unauthorized access, execute arbitrary code, and compromise sensitive data within the affected environment.
Search
1
2| from datamodel Web.Web
3| rex field=_raw max_match=0 "[jJnNdDiI]{4}(\:
4|\%3A
5|\/
6|\%2F)(?<proto>\w+)(\:\/\/
7|\%3A\%2F\%2F)(\$\{.*?\}(\.)?)?(?<affected_host>[a-zA-Z0-9\.\-\_\$]+)"
8| join affected_host type=inner [
9| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Network_Traffic.All_Traffic by All_Traffic.dest
10| `drop_dm_object_name(All_Traffic)`
11| `security_content_ctime(firstTime)`
12| `security_content_ctime(lastTime)`
13| rename dest AS affected_host]
14| fillnull
15| stats count by action, category, dest, dest_port, http_content_type, http_method, http_referrer, http_user_agent, site, src, url, url_domain, user
16| `log4shell_jndi_payload_injection_with_outbound_connection_filter`
Data Source
Name | Platform | Sourcetype | Source | Supported App |
---|---|---|---|---|
N/A | N/A | N/A | N/A | N/A |
Macros Used
Name | Value |
---|---|
security_content_ctime | convert timeformat="%Y-%m-%dT%H:%M:%S" ctime($field$) |
log4shell_jndi_payload_injection_with_outbound_connection_filter | search * |
log4shell_jndi_payload_injection_with_outbound_connection_filter
is an empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
Annotations
Default Configuration
This detection is configured by default in Splunk Enterprise Security to run with the following settings:
Setting | Value |
---|---|
Disabled | true |
Cron Schedule | 0 * * * * |
Earliest Time | -70m@m |
Latest Time | -10m@m |
Schedule Window | auto |
Creates Risk Event | True |
Implementation
This detection requires the Web datamodel to be populated from a supported Technology Add-On like Splunk for Apache or Splunk for Nginx.
Known False Positives
If there is a vulnerablility scannner looking for log4shells this will trigger, otherwise likely to have low false positives.
Associated Analytic Story
Risk Based Analytics (RBA)
Risk Message | Risk Score | Impact | Confidence |
---|---|---|---|
CVE-2021-44228 Log4Shell triggered for host $dest$ | 15 | 50 | 30 |
References
Detection Testing
Test Type | Status | Dataset | Source | Sourcetype |
---|---|---|---|---|
Validation | ✅ Passing | N/A | N/A | N/A |
Unit | ✅ Passing | Dataset | nginx |
nginx:plus:kv |
Integration | ✅ Passing | Dataset | nginx |
nginx:plus:kv |
Replay any dataset to Splunk Enterprise by using our replay.py
tool or the UI.
Alternatively you can replay a dataset into a Splunk Attack Range
Source: GitHub | Version: 2