Splunk search to find out CVE-2021-44228(Apache Log4j Remote Code Execution）

[jaibalaraman]

Hi Team 

I am trying to find out recent CVE-2021-44228( log4j)

I tried " index=aws *log4j*", nut not sure how to find out and create an alert based on this Vulnerability. 

Can anyone help me with the correct search and explain how to create an alert based on this vulnerability

Thanks 

[bowesmana]

https://www.splunk.com/en_us/blog/security/log-jammin-log4j-2-rce.html

[jaibalaraman]

Hi 

Yes, i tried the page, but the search is not working for me 

Could you please me to understand why its not working 

[PickleRick]

What are you trying to do?

Are you trying to locate the vulnerability within your infrastructure? You can't do that with splunk alone.

Or are you trying to see if someone already attempted to exploit it? In this case you simply might not have recorded any exploitation attempts.

[jaibalaraman]

Hi 

yes i am trying to find out list out servers affected with this vulnerability and what to find out is there any new attempt was initiated with the user agent. 

Thanks

[PickleRick]

OK. To find which of your servers are vulnerable (use the vulnerable library) you need a completely different tool - some form of software inventory solution and/or vulnerability scanner/manager.

To find out whether someone already tried to exploit this CVE, you have a nice splunk blog post https://www.splunk.com/en_us/blog/security/log4shell-detecting-log4j-vulnerability-cve-2021-44228-co...