A SQL query that can be run as a realtime query in osquery to yara scan all log files opened by processes running inside a container to detect log4j vulnerability CVE-2021-44228

gistfile1.txt

WITH
logs AS (
  SELECT DISTINCT path, system_id, system_type
  FROM process_open_files
  WHERE system_type = 'docker_container'
        AND path LIKE '%.log'),
open AS (
  SELECT d.name, d.image, d.image_id, l.*
  FROM docker_containers d, logs l
  WHERE d.id = l.system_id)
SELECT * FROM yara
JOIN open j
USING (path, system_type, system_id)
WHERE count > 0
      AND rule = '
rule log4j2JndiLookup {
  meta:
    author = "Uptycs Team"
    description = "Detect indicator of comprimise for log4j2 vulnerability CVE-2021-44228 in log files"
    license = "Apache License, Version 2.0"
    version = "0.1"

  strings:
    // Check for ${jndi or ${ctx prefix matches
    $prefix = /\$\{(jndi|ctx)/ ascii wide

    // Look for patterns starting with "${", followed by anything except "}" and ending with "${"
    $nested = /\$\{[^\}\r\n]*\$\{/ ascii wide

  condition:
    any of them
}'