Neo23x0

log4j RCE Exploitation Detection

You can use these commands and rules to search for exploitation attempts against log4j RCE vulnerability CVE-2021-44228

Grep / Zgrep

This command searches for exploitation attempts in uncompressed files in folder /var/log and all sub folders

sudo egrep -I -i -r '\$(\{|%7B)jndi:(ldap[s]?|rmi|dns|nis|iiop|corba|nds|http):/[^\n]+' /var/log

nadouani

play.http.secret.key="ThehiveTestPassword"

## For test only !
db.janusgraph {
   storage.backend: berkeleyje
   storage.directory: /tmp/
   berkeleyje.freeDisk: 200
}

storage {

mda590

import boto3

ec2 = boto3.resource('ec2')

def lambda_handler(event, context):
    # create filter for instances in running state
    filters = [
        {
            'Name': 'instance-state-name', 
            'Values': ['running']

btoews

# file: merger.py
# based off: http://cmikavac.net/2011/07/09/merging-multiple-nessus-scans-python-script/
# by: mastahyeti

import xml.etree.ElementTree as etree
import shutil
import os

first = 1
for fileName in os.listdir("."):