Log4j CVE-2021-44228 by

Back Up Data

hsbjtq26mq — 2022-04-23 12:41:39 UTC

If data is kept by attackers for ransomeware, a good back up will deter this.

Staff Training

hsbjtq26mq — 2022-04-23 12:43:32 UTC

Staff should be aware to spot key signatures of Log4j attacks

CVE 2021-44228:

hsbjtq26mq — 2022-04-23 12:44:23 UTC

Log4Shell - can be exploited from remote by an unauthenticated adversary to executed arbitrary code (remote code execution – RCE)CRITICALITY - score of 10 (out of 10)

Restricted PowerShell

hsbjtq26mq — 2022-04-23 12:45:40 UTC

Restrict the powerful commands that can be used in the power shell on workstations.

Employ Back up Servers

hsbjtq26mq — 2022-04-23 12:52:20 UTC

If Web servers are attacked, they may become non-operational or the digital forensic team will need to shut them down for evidence collection

Check Public Internet Exposure to Java software

hsbjtq26mq — 2022-04-23 13:01:04 UTC

Are the Java processes using these libraries directly accessible from the internet?

Sensitive Data Access

hsbjtq26mq — 2022-04-23 13:01:30 UTC

Do the vulnerable Java processes access critical databases or file systems in the environment?

Create an Application List

hsbjtq26mq — 2022-04-23 13:01:56 UTC

Which applications use these java log4j libraries?

Look for Java Making Network Connections

hsbjtq26mq — 2022-04-23 13:04:15 UTC

QQL queries in Qualys EDR can isolate hosts which have these types of connection

Look for Java Calling Suspicious Processes

hsbjtq26mq — 2022-04-23 13:09:31 UTC

Commonly you will see something such as scripting languages or data transfer utilities to call for processes. QQL queries can be used to find such activity

Microsoft 365 Defender

hsbjtq26mq — 2022-04-23 13:10:52 UTC

Microsoft 365 Defender coordinates multiple security solutions that detect components of observed attacks taking advantage of this vulnerability, from exploitation attempts to remote code execution and post-exploitation activity.

Microsoft Defender For End-Point

hsbjtq26mq — 2022-04-23 13:13:26 UTC

Users of Microsoft Defender for Endpoint can turn on the following attack surface reduction rule to block or audit some observed activity associated with this threat.

Use a log inspection rule

hsbjtq26mq — 2022-04-23 13:14:14 UTC

consists of a list of files to monitor for changes and a set of conditions to be met for the rule to trigger.

The log inspection rule 1011241 – Apache Log4j Remote Code Execution Vulnerability (CVE-2021-44228) looks for JNDI payloads in the access logs, with the default path being /var/log/*/access. log.

Check Indicators of Compromise

hsbjtq26mq — 2022-04-23 13:16:06 UTC

Infoblox provides the following list of indicators of compromise (IOCs) related to Log4j exploitation activity.

Apache Tomcat servers

hsbjtq26mq — 2022-04-23 13:25:05 UTC

Allows for redirection of traffic and remote access to server.

Version < 9.X was vulnerable.

Cisco Firewall Threat Defence (FTD)

hsbjtq26mq — 2022-04-23 13:27:09 UTC

Attacks on this would allow attackers to disable firewalls to allow all traffic entering the network.

Version 6.6.0 is vulnerable to log4shell

Dell EMC Connectrix

hsbjtq26mq — 2022-04-23 13:29:04 UTC

Version < 3 are vulnerable to log4shell

AWS Servers

hsbjtq26mq — 2022-04-23 13:30:16 UTC

Allowed for full host take over, meaning data can be stolen or the integrity can be changed.

Version < 2.5 Vulnerable to Log4shell

Adobe Coldfusion

hsbjtq26mq — 2022-04-23 13:31:53 UTC

Allowed for remote access to workstations.

Vulnerable version < 1.2.15

Apache Tomcat

hsbjtq26mq — 2022-04-23 13:33:52 UTC

Vulnerability Fixed in Apache Tomcat versions 9.x

Cisco

hsbjtq26mq — 2022-04-23 13:35:51 UTC

Developer response, all Cisco products have been updated

Dell Response

hsbjtq26mq — 2022-04-23 13:36:39 UTC

AWS Servers Response

hsbjtq26mq — 2022-04-23 13:37:42 UTC

Version 6 was the latest update implemented to deal with CVE-2021-44288

Adobe Coldfusion Response

hsbjtq26mq — 2022-04-23 13:38:31 UTC

Are the organization's products with Log4j are vulnerable?

hsbjtq26mq — 2022-04-23 13:46:05 UTC

Check Here

Restrict egress capabilities from applications and servers.

hsbjtq26mq — 2022-04-23 13:47:53 UTC

This step will prevent the Java service from having the ability to download a malicious class file via LDAP, LDAPS, RMI, or DNS.

Reduce attack surface on applications running impacted software.

hsbjtq26mq — 2022-04-23 13:50:54 UTC

Limit applications interfaces to prevent leveraging of interfaces

Implement Current Patches For All Software

hsbjtq26mq — 2022-04-23 13:51:44 UTC

Isolate System

hsbjtq26mq — 2022-04-23 13:52:53 UTC

Affected software should be powered off and removed from the network to prevent the spreading of the attack

Apply latest patches to software

hsbjtq26mq — 2022-04-23 13:53:15 UTC

Virtual Machines

hsbjtq26mq — 2022-04-23 13:54:42 UTC

Power Down Virtual Machine and prepare a clone of current state for evidence. If possible restore Virtual machine from the last known good screenshot.

Minimize the attack area

hsbjtq26mq — 2022-04-23 14:00:49 UTC

- Switch to a virtual machine

- Or use an account with the least amount of privileges

Install Firewall

hsbjtq26mq — 2022-04-23 14:01:22 UTC

Use firewalls to isolate the environment

Install Recent Patches

hsbjtq26mq — 2022-04-23 14:01:48 UTC

Import Back-ups

hsbjtq26mq — 2022-04-23 14:06:16 UTC

Import back up webservers, data and other information

Monitor Network

hsbjtq26mq — 2022-04-23 14:07:44 UTC

Monitor Network for any unknown packets, abnormal hosts or network activity.

Employ Active Defence

hsbjtq26mq — 2022-04-23 14:10:34 UTC

These can include:

- Boarder Gateway Protocol Monitoring

- Honeypot used to trick attackers to targeting a fake system

Check For Any EDR/XDR Detections Frequently

hsbjtq26mq — 2022-04-23 14:12:45 UTC

Dealing with Evidence

hsbjtq26mq — 2022-04-23 14:16:40 UTC

- Record Cryptographic hash of system
- Switch systems to backup (if possible)
- Disconnect System from network
- Leave systems in the state they're in for evidence collection
- Document process

Evidence Storing

hsbjtq26mq — 2022-04-23 14:17:19 UTC

- Stored in a room with proper physical security

Copying Digital Evidence

hsbjtq26mq — 2022-04-23 14:19:00 UTC

- Digital Forensics team will use hard-drive duplicators or software imaging tools to clone the entire hard drive for analysis.

- The copy must be stored on another form of media to keep the original integrity.

- Must be stored on "clean" media that doesn't contain information already

Install Write-blockers

hsbjtq26mq — 2022-04-23 14:20:05 UTC

prevent any change to the data on the device or media, so that data may be viewed but nothing can be changed or added.

Disconnect Devices/Services

hsbjtq26mq — 2022-04-23 14:22:18 UTC

- Wireless devices must be examined in isolation chamber (or faraday bag) to prevent any contamination

- Device must be connected to analyse software in chamber

Extraction Methods

hsbjtq26mq — 2022-04-23 14:25:39 UTC

Determines highly on the data, software and hardware the attack has happened on.

Analyse Methods

hsbjtq26mq — 2022-04-23 14:32:35 UTC

Disk can be forensically analysed using specialised software. This could include FTK imager, Autopsy or commercial products that will scan your network and detect any red flags

Log4j Vulnerability Scanner

hsbjtq26mq — 2022-04-23 14:47:49 UTC

How Log4shell works

hsbjtq26mq — 2022-04-23 14:51:47 UTC

How the attacks abuses the vulnerability

Are You Vulnerable ?

hsbjtq26mq — 2022-04-23 14:52:39 UTC

Vulnerability Scanner for Organisations Services

hsbjtq26mq — 2022-04-25 12:00:26 UTC

Tenable Scanner

hsbjtq26mq — 2022-04-25 12:01:15 UTC

Log4shell FAQ

hsbjtq26mq — 2022-04-25 12:01:59 UTC

Greenbone Log4shell Scanner

hsbjtq26mq — 2022-04-25 12:02:46 UTC

List of Indicators of Compromise

hsbjtq26mq — 2022-04-25 12:26:19 UTC