topic Splunk search to find out CVE-2021-44228(Apache Log4j Remote Code Execution） in Splunk Search

Splunk search to find out CVE-2021-44228(Apache Log4j Remote Code Execution）

jaibalaraman — Mon, 13 Dec 2021 00:58:49 GMT

Hi Team

I am trying to find out recent CVE-2021-44228( log4j)

I tried " index=aws *log4j*", nut not sure how to find out and create an alert based on this Vulnerability.

Can anyone help me with the correct search and explain how to create an alert based on this vulnerability

Thanks

Re: Splunk search to find out CVE-2021-44228(Apache Log4j Remote Code Execution）

bowesmana — Mon, 13 Dec 2021 02:52:55 GMT

https://www.splunk.com/en_us/blog/security/log-jammin-log4j-2-rce.html

Re: Splunk search to find out CVE-2021-44228(Apache Log4j Remote Code Execution）

jaibalaraman — Mon, 13 Dec 2021 06:12:48 GMT

Yes, i tried the page, but the search is not working for me

Could you please me to understand why its not working

Re: Splunk search to find out CVE-2021-44228(Apache Log4j Remote Code Execution）

PickleRick — Mon, 13 Dec 2021 07:28:02 GMT

What are you trying to do?

Are you trying to locate the vulnerability within your infrastructure? You can't do that with splunk alone.

Or are you trying to see if someone already attempted to exploit it? In this case you simply might not have recorded any exploitation attempts.

Re: Splunk search to find out CVE-2021-44228(Apache Log4j Remote Code Execution）

jaibalaraman — Mon, 13 Dec 2021 18:06:47 GMT

yes i am trying to find out list out servers affected with this vulnerability and what to find out is there any new attempt was initiated with the user agent.

Thanks

Re: Splunk search to find out CVE-2021-44228(Apache Log4j Remote Code Execution）

PickleRick — Tue, 14 Dec 2021 17:22:25 GMT

OK. To find which of your servers are vulnerable (use the vulnerable library) you need a completely different tool - some form of software inventory solution and/or vulnerability scanner/manager.

To find out whether someone already tried to exploit this CVE, you have a nice splunk blog post https://www.splunk.com/en_us/blog/security/log4shell-detecting-log4j-vulnerability-cve-2021-44228-continued.html