Neo23x0

log4j RCE Exploitation Detection

You can use these commands and rules to search for exploitation attempts against log4j RCE vulnerability CVE-2021-44228

Grep / Zgrep

This command searches for exploitation attempts in uncompressed files in folder /var/log and all sub folders

sudo egrep -I -i -r '\$(\{|%7B)jndi:(ldap[s]?|rmi|dns|nis|iiop|corba|nds|http):/[^\n]+' /var/log

marcguyer

<?php

class My_Mail_Protocol_Smtp_Auth_Login extends My_Mail_Protocol_Smtp
{
    /**
     * LOGIN username
     *
     * @var string
     */
    protected $_username;

danieldogeanu

You should not use the Open SSH client that comes with Git for Windows. Instead, Windows 10 has its own implementation of Open SSH that is integrated with the system. To achieve this:

1. Start the ssh-agent from Windows Services:

• Type Services in the Start Menu or Win+R and then type services.msc to launch the Services window;
• Find the OpenSSH Authentication Agent in the list and double click on it;
• In the OpenSSH Authentication Agent Properties window that appears, choose Automatic from the Startup type: dropdown and click Start from Service status:. Make sure it now says Service status: Running.

2. Configure Git to use the Windows 10 implementation of OpenSSH by issuing the following command in Powershell:

git config --global core.sshCommand C:/Windows/System32/OpenSSH/ssh.exe

subfuzion

Common Options

-#, --progress-bar Make curl display a simple progress bar instead of the more informational standard meter.

-b, --cookie <name=data> Supply cookie with request. If no =, then specifies the cookie file to use (see -c).

-c, --cookie-jar <file name> File to save response cookies to.