Repository navigation
The Day After Log4Shell - #1887
Merged
Merged
Conversation
…content into The_Day_After_Log4shell
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
…content into The_Day_After_Log4shell
…content into The_Day_After_Log4shell
Collaborator
|
This PR was created by Automated Detection Testing Service 🤖 Tested detections: Hunting for Log4Shell ✅
|
patel-bhavin
previously approved these changes
Dec 15, 2021
ljstella
self-requested a review
December 15, 2021 02:41
patel-bhavin
approved these changes
Dec 15, 2021
josehelps
commented
Dec 15, 2021
| reaching out to default ports used by the LDAP and RMI protocols. This behavior | ||
| could represent successfull exploitation. Note that adversaries can easily decide to use | ||
| arbitrary ports for these protocols and potentially bypass this detection. | ||
| search: ' `sysmon` EventCode=3 (process_name=java OR process_name=java.exe) (DestinationPort=389 |
Contributor
Author
There was a problem hiding this comment.
hey man, any reason why this could not be built against a datamodel?
This branch was previously deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
6 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
New Story
adds a new analytic story called
Log4Shell CVE-2021-44228New Analytics
Updated Analytics
Other
contentctl newjinja template