An Log4Shell convenience scanner for Microsoft Windows-based systems based on Velociraptor and yara (CVE-2021-44228), first released on https://www.itrelation.dk/log4shell December 15th, 2021.
This is a convenience scanner of the affected Apache Log4J versions of CVE-2021-44228 either used directly as dependencies in software and applications, or embedded and packaged within.
See more at https://www.itrelation.dk/log4shell (danish).
| Will this? | ✅❌ |
|---|---|
| Remediate the vulnerability | ❌ |
| Find possible indicators of Log4J on a windows system? | ✅ |
| Find all possible variants of Log4J even if it's heavily modified from the vendor side | ❌ |
- Download or clone this repository.
- Run either "run_64bit.ps1" or "run_32bit.ps1" by right-clicking the file and choosing "Run with powershell".
- A powershell-window will be open as long as the scanner is running, when done it will close.
- Initial benchmarking of the scanner is set to 20-30 minutes for a run, velociraptor is set with the --cpu-limit=5 flag to avoid disruptions, this can of course be removed if wanted in the .ps1 files.
- A file named
log4j_SEE_YOUR_RESULTS_HERE.zipshould be put in the directory of the scanner. - Unzip this file and open either the json or csv file to see where it found possible indicators of the affected Log4J version.
- Mounted network drives can cause issues and large wait times for the scan, please consider disconnecting these before starting.
If you would like to contribute:
- Fork the repository
- Make and push your contributions
- Make a Pull Request
This repository, and anything within, comes "as-is". IT Relation CDC does not provide support or similar in regards to running the scanner, or in understanding the result outside of what is found in this README.
IT Relation CDC provides services as listed within our RFC2350.
This repository is licensed under the AGPL-3.0 license - please see LICENSE for license details.
mgreen27- Velociraptor Artifact
This repository and software comes as-is. IT Relation CDC, authors, and contributors of this repository assumes no responsibility for errors or omissions, or for damages resulting from the use of the information and software contained within. As such, IT Relation CDC, authors, and contributors of this repository assumes no liability nor obligation as arising from the provision herein.