Log4j Wazuh

rules.xml

<group name="web,">
  <rule id="100134" level="8">
    <if_sid>31108, 31100</if_sid>
    <regex>\${jndi:ldap:|\${jndi:rmi:|\${jndi:ldaps:|\${jndi:dns:|\${jndi:iiop:|\${jndi:http:|\${jndi:nis:|\${jndi:nds:|\${jndi:corba:|\${::-i}|\${lower:|\${upper:\$</regex>
    <description>Log4Shell - Detects indicators in server logs that indicate an exploitation attempt of CVE-2021-44228</description>
  </rule>
  <rule id="100135" level="8">
   <if_sid>31108, 31100, 31120</if_sid>
   <regex>\S%7Bjndi\S|\$%7Bjndi\S|%2524%257Bjndi|%2F%252524%25257Bjndi%3A|\${jndi:\${lower:|\${::-j}\${|\${\${env:BARFOO:-j}|\${::-l}\${::-d}\${::-a}\${::-p}|\${base64:JHtqbmRp|\${\${upper:j}\${upper:n}\${upper:d}\${upper:i}|\${\${upper:j}\${upper:n}\${upper:d}\${lower:i}|\${\${upper:j}\${upper:n}\${lower:d}\${upper:i}|\${\${upper:j}\${upper:n}\${lower:d}\${lower:i}|\${\${upper:j}\${lower:n}\${upper:d}\${upper:i}|\${\${upper:j}\${lower:n}\${upper:d}\${lower:i}|\${\${upper:j}\${lower:n}\${lower:d}\${upper:i}|\${\${upper:j}\${lower:n}\${lower:d}\${lower:i}|\${\${lower:j}\${upper:n}\${upper:d}\${upper:i}|\${\${lower:j}\${upper:n}\${upper:d}\${lower:i}|\${\${lower:j}\${upper:n}\${lower:d}\${upper:i}|\${\${lower:j}\${upper:n}\${lower:d}\${lower:i}|\${\${lower:j}\${lower:n}\${upper:d}\${upper:i}|\${\${lower:j}\${lower:n}\${upper:d}\${lower:i}|\${\${lower:j}\${lower:n}\${lower:d}\${upper:i}|\${\${lower:j}\${lower:n}\${lower:d}\${lower:i}</regex>
   <description>Log4Shell - Detects obfuscated indicators in server logs that indicate an exploitation attempt of CVE-2021-44228</description>
 </rule>
</group>

Added updated Rule

<rule id="100135" level="8">
   <if_sid>31108, 31100, 31120</if_sid>
   <regex>\S%7Bjndi\S|\$%7Bjndi\S|%2524%257Bjndi|%2F%252524%25257Bjndi%3A|\${jndi:\${lower:|\${::-j}\${|\${\${env:BARFOO:-j}|\${::-l}\${::-d}\${::-a}\${::-p}|\${base64:JHtqbmRp|\${\${upper:j}\${upper:n}\${upper:d}\${upper:i}|\${\${upper:j}\${upper:n}\${upper:d}\${lower:i}|\${\${upper:j}\${upper:n}\${lower:d}\${upper:i}|\${\${upper:j}\${upper:n}\${lower:d}\${lower:i}|\${\${upper:j}\${lower:n}\${upper:d}\${upper:i}|\${\${upper:j}\${lower:n}\${upper:d}\${lower:i}|\${\${upper:j}\${lower:n}\${lower:d}\${upper:i}|\${\${upper:j}\${lower:n}\${lower:d}\${lower:i}|\${\${lower:j}\${upper:n}\${upper:d}\${upper:i}|\${\${lower:j}\${upper:n}\${upper:d}\${lower:i}|\${\${lower:j}\${upper:n}\${lower:d}\${upper:i}|\${\${lower:j}\${upper:n}\${lower:d}\${lower:i}|\${\${lower:j}\${lower:n}\${upper:d}\${upper:i}|\${\${lower:j}\${lower:n}\${upper:d}\${lower:i}|\${\${lower:j}\${lower:n}\${lower:d}\${upper:i}|\${\${lower:j}\${lower:n}\${lower:d}\${lower:i}</regex>
   <description>Log4Shell - Detects obfuscated indicators in server logs that indicate an exploitation attempt of CVE-2021-44228</description>
 </rule>

From Bruno Olivera in the wazuh slack channel.