Trend Micro Solutions	Major Products	Latest Versions	Virus Pattern	Anti-Spam Pattern	Network Pattern	Behavior Monitoring	Predictive Machine Learning	Web Reputation
Endpoint Security	ApexOne	2019 (Critical Patch - Server Build 9204 and Agent Build 9179)	Update pattern via web console	Not Applicable	Update pattern via web console	Enable Behavior Monitoring and update pattern via web console	Enable Predictive Machine Learning	Enable Web Reputation Service and update pattern via web console
Worry-Free Business Security	Standard (10.0)
Advanced (10.0)	Update pattern via web console
Hybrid Cloud Security	Deep Security	20.0	Update pattern via web console	Not Applicable	Update pattern via web console	Enable Behavior Monitoring and update pattern via web console	Enable Predictive Machine Learning	Enable Web Reputation Service and update pattern via web console
Cloud One - File Storage Security (SaaS)	N/A	Updated Automatically	Not Applicable	Not Applicable	Not Applicable	Not Applicable
Cloud One - Application Security (SaaS)	Updated automatically
Cloud One - Container Security (SaaS)	Not applicable
Email and Gateway Security	Deep Discovery Email Inspector	5.1	Update pattern via web console	Update pattern via web console	Update pattern via web console	Not Applicable	Enable Predictive Machine Learning	Enable Web Reputation Service and update pattern via web console
InterScan Messaging Security	9.1	Not Applicable	Not Applicable
InterScan Web Security / InterScan Web Security Virtual Appliance	6.5
ScanMail for Microsoft Exchange	14.0
Cloud App Security (SaaS)	N/A	Updated Automatically	Updated Automatically	Enable Predictive Machine Learning
Email Security (SaaS)
Network Security	Deep Discovery Inspector	5.8	Update pattern via web console	Not Applicable	Update pattern via web console	Not Applicable	Not Applicable	Enable Web Reputation Service and update pattern via web console

Log4Shell Malware Information

Product / Version includes:

Trend Micro Email SecurityAll , Apex One2019 , Cloud App SecurityAll , Deep Discovery InspectorAll , Cloud One - Application SecurityAll , Cloud One - Container SecurityAll , Interscan Web Security Virtual ApplianceAll , Deep SecurityAll , Worry-Free Business Security StandardAll , InterScan Messaging Security SuiteAll , Deep Discovery Email InspectorAll , Cloud One - File Storage SecurityAll , ScanMail for ExchangeAll , Worry-Free Business Security AdvancedAll

Last updated: 2024/03/22

Solution ID: KA-0012640

Category: Remove a Malware / Virus

Summary

On December 9, 2021, a new critical 0-day vulnerability impacting multiple versions of the popular Apache Log4j 2 logging library was publicly disclosed that, if exploited, could result in Remote Code Execution (RCE) by logging a certain string on affected installations.

This specific vulnerability has been assigned CVE-2021-44228 and is also being commonly referred to as "Log4Shell" in various blogs and reports.

This CVE-2021-44228 is a Java Naming and Directory InterfaceTM (JNDI) injection vulnerability in the affected versions of Log4j listed above. It can be triggered when a system using an affected version of Log4j 2 includes untrusted data in the logged message. If this data includes a crafted malicious payload, a JNDI lookup is made to a malicious server. Depending on the information sent back (response), a malicious Java object may be loaded, which could eventually lead to RCE. Additionally, attackers who can control log messages or their parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled.

AFFECTED SOFTWARE

Apache Struts
Apache Solr
Apache Druid
Apache Flink
ElasticSearch
Flume
Apache Dubbo
Logstash
Kafka
Spring-Boot-starter-log4j2

INFECTION ROUTINE

AVAILABLE SOLUTIONS

File Reputation

Detection/Policy/Rules	Pattern Branch/Version	Release Date
Trojan.Linux.MIRAI.SEMR Backdoor.Linux.MIRAI.SMF Backdoor.Linux.MIRAI.SME	17.247.00	12 Dec 2021
Trojan.SH.CVE20207961.SM	17.247.00	13 Dec 2021
Backdoor.Linux.MIRAI.SEMR Trojan.SH.MIRAI.MKF Coinminer.Linux.KINSING.D	17.248.04	13 Dec 2021

Predictive Machine Learning

Detection	Pattern Branch/Version
Troj.ELF.TRX.XXELFC1DFF009	In-the-cloud
Troj.ELF.TRX.XXELFC1DFF012	In-the-cloud

Behavior Monitoring

Pattern Branch/Version	Release Date
SEN5985S / TMTD 2565	12 Dec 2021

Web Reputation

URL	Category	Blocking Date
URL Protection (Over 1700 URLs blocked)	Malware Accomplice	In-the-cloud

NETWORK PATTERN

Trend Micro Cloud One - Workload Security and Deep Security IPS Rules

Rule 1011242 - Log4j Remote Code Execution Vulnerability (CVE-2021-44228)
Rule 1005177 - Restrict Java Bytecode File (Jar/Class) Download
Rule 1008610 - Block Object-Graph Navigation Language (OGNL) Expressions Initiation In Apache Struts HTTP Request

Trend Micro Cloud One - Workload Security and Deep Security Log Inspection

LI Rule 1011241 - Apache Log4j Remote Code Execution Vulnerability (CVE-2021-44228)

Trend Micro Cloud One - Network Security and TippingPoint DVToolkit CSW file CVE-2021-44228

Filter C1000001 : HTTP: JNDI Injection in HTTP Header or URI

Trend Micro Deep Discovery Inspector

Proactive Detection:
- DDI Rule 4280: "HTTP_POSSIBLE_USERAGENT_RCE_EXPLOIT_REQUEST"
Protection Solutions:
- Released in NCIP 1.14747.00:
  - DDI Rule 4641:"CVE-2021-44228 - OGNL EXPLOIT - HTTP(REQUEST)"
  - DDI Rule 4643:"POSSIBLE HTTP BODY OGNL EXPRESSION EXPLOIT - HTTP (REQUEST) - Variant 2" (disabled by default)
- Released in NCIP 1.14749.00:
  - DDI Rule 4642:"POSSIBLE HTTP HEADER OGNL EXPRESSION EXPLOIT - HTTP(REQUEST)"

Solution Map - What should customers do?

Trend Micro Solutions	Major Products	Latest Versions	Virus Pattern	Anti-Spam Pattern	Network Pattern	Behavior Monitoring	Predictive Machine Learning	Web Reputation
Endpoint Security	ApexOne	2019 (Critical Patch - Server Build 9204 and Agent Build 9179)	Update pattern via web console	Not Applicable	Update pattern via web console	Enable Behavior Monitoring and update pattern via web console	Enable Predictive Machine Learning	Enable Web Reputation Service and update pattern via web console
	Worry-Free Business Security	Standard (10.0)
	Worry-Free Business Security	Advanced (10.0)			Update pattern via web console
Hybrid Cloud Security	Deep Security	20.0	Update pattern via web console	Not Applicable	Update pattern via web console	Enable Behavior Monitoring and update pattern via web console	Enable Predictive Machine Learning	Enable Web Reputation Service and update pattern via web console
	Cloud One - File Storage Security (SaaS)	N/A	Updated Automatically		Not Applicable	Not Applicable	Not Applicable	Not Applicable
	Cloud One - Application Security (SaaS)				Updated automatically
	Cloud One - Container Security (SaaS)				Not applicable
Email and Gateway Security	Deep Discovery Email Inspector	5.1	Update pattern via web console	Update pattern via web console	Update pattern via web console	Not Applicable	Enable Predictive Machine Learning	Enable Web Reputation Service and update pattern via web console
	InterScan Messaging Security	9.1			Not Applicable		Not Applicable
	InterScan Web Security / InterScan Web Security Virtual Appliance	6.5
	ScanMail for Microsoft Exchange	14.0
	Cloud App Security (SaaS)	N/A	Updated Automatically	Updated Automatically			Enable Predictive Machine Learning
	Email Security (SaaS)
	Network Security								Deep Discovery Inspector	5.8	Update pattern via web console	Not Applicable	Update pattern via web console	Not Applicable	Not Applicable	Enable Web Reputation Service and update pattern via web console

To update TrendMicro products, you may refer to the Online Help Center.

Recommendations

Make sure to always use the latest pattern available. Please refer to the recommendations on how to best protect your network using Trend Micro products.
You may also check the article on submitting suspicious or undetected virus for file analysis to Technical Support.
For support assistance, please contact Trend Micro Technical Support.

Threat Reports

Other Information

SECURITY ALERT: Apache Log4j "Log4Shell" Remote Code Execution 0-Day Vulnerability (CVE-2021-44228)

Was this article helpful?

Featured

Automation Center

Education Portal

Online Help Center

Service Status

TrendConnect

Log4Shell Malware Information

Solution Map - What should customers do?

Recommendations

Threat Reports

Other Information

Log4Shell Malware Information

Product / Version includes:

Summary

AFFECTED SOFTWARE

INFECTION ROUTINE

AVAILABLE SOLUTIONS

NETWORK PATTERN

Solution Map - What should customers do?

Recommendations

Threat Reports

Other Information