Edo Maland screetsec

## log4j_rce_detection.md

      
              1 file
            
          
              72 forks
            
          
                70 comments
              
            
              509 stars
            
          
                Neo23x0
                / log4j_rce_detection.md
            
            
              Last active
              September 11, 2024 21:41
            
              
                Log4j RCE CVE-2021-44228 Exploitation Detection
              
          
    log4j RCE Exploitation Detection

You can use these commands and rules to search for exploitation attempts against log4j RCE vulnerability CVE-2021-44228
Grep / Zgrep

This command searches for exploitation attempts in uncompressed files in folder /var/log and all sub folders
sudo egrep -I -i -r '\$(\{|%7B)jndi:(ldap[s]?|rmi|dns|nis|iiop|corba|nds|http):/[^\n]+' /var/log

  
## iranian_apit_groups_possible_commands.md

      
              1 file
            
          
              36 forks
            
          
                0 comments
              
            
              99 stars
            
          
                MSAdministrator
                / iranian_apit_groups_possible_commands.md
            
            
              Last active
              December 6, 2024 08:14
            
              
                Iranian APT Groups & Possible Commands Used By These Groups
              
          
    Overview

The following content is generated using a preview release of Swimlane's pyattck.
This snippet of data is scoped to the following actor groups:

APT33
APT34
APT39
Charming Kitten