POC详情： fab630c2d204768dd136f9a98459ba93666f2477

来源
https://github.com/fireeye/CVE-2021-44228
关联漏洞
标题： Apache Log4j 代码问题漏洞 (CVE-2021-44228)
描述：Apache Log4j是美国阿帕奇（Apache）基金会的一款基于Java的开源日志记录工具。 Apache Log4J 存在代码问题漏洞，攻击者可设计一个数据请求发送给使用 Apache Log4j工具的服务器，当该请求被打印成日志时就会触发远程代码执行。
描述
OpenIOC rules to facilitate hunting for indicators of compromise
介绍
# Overview
This repository contains OpenIOC rules to facilitate hunting for indicators of compromise related to the Apache Log4j 2 remote code execution vulnerability (CVE-2021-44228).

These rules are considered hunting rules and as such detection efficacy will vary by organization. With environment-specific tuning these rules may be suitable for deployment as alerting rules. The rules are organized into two categories:

* execution - IOCs that provide evidence that something *previously executed* on the system that may be related to this CVE such as suspicous network connections, URL requests, process exeuctions, and file writes
* presence - IOCs related to this CVE that provide evidence that an actively running process or file is present on the system

FireEye customers can refer to the FireEye Community (community.fireeye.com) for additional information on how FireEye products detect these threats.

These rules are provided freely to the community without warranty.
文件快照

 [4.0K]  /data/pocs/fab630c2d204768dd136f9a98459ba93666f2477
├── [ 984]  README.md
└── [4.0K]  rules
    ├── [4.0K]  execution
    │   ├── [2.2K]  3e9cbdaf-1da4-4a55-b453-912d0a75e337.ioc
    │   ├── [ 16K]  45c3e506-71bb-49eb-9157-efb81904d880.ioc
    │   ├── [ 15K]  5e3cd7b3-4844-4fe5-8d08-2f71cad53c5c.ioc
    │   ├── [9.1K]  61ca256a-1f03-40a4-a6c5-692d28a89699.ioc
    │   ├── [4.8K]  a7fb0010-d330-4628-a454-d196d62c5490.ioc
    │   └── [ 16K]  cd73767d-361f-4ccb-8898-6b9f3fb7402f.ioc
    └── [4.0K]  presence
        ├── [ 32K]  312597aa-77ba-4ab9-820c-72926115d3b8.ioc
        ├── [2.2K]  6a4bb38d-5232-4b2b-975a-955aab4c4b63.ioc
        └── [2.2K]  ae3b8c89-383e-451b-b1e0-f359dc359ea9.ioc

3 directories, 10 files
神龙机器人已为您缓存
备注
    1. 建议优先通过来源进行访问。
    2. 如果因为来源失效或无法访问，请发送邮箱到 f.jinxu#gmail.com 索取本地快照（把 # 换成 @）。
    3. 神龙已为您对POC代码进行快照，为了长期维护，请考虑为本地POC付费，感谢您的支持。