{"slug":"log4shell","title":"Log4Shell (CVE-2021-44228)","shortName":"Log4Shell","summary":"Unauthenticated remote code execution in Apache Log4j 2 via JNDI lookup substitution in log messages. CVSS 10.0. Exploited at planetary scale from Dec 2021. Listed in CISA KEV on 10 Dec 2021.","isExample":false,"draft":false,"family":"log4shell","kind":"shared-component","aliases":["CVE-2021-44228","Log4j RCE","Log4j2 JNDI"],"publishedAt":"2021-12-10","updatedAt":"2026-10-24","patchStatus":"patched","exploited":true,"scores":{"cve":"CVE-2021-44228","cvss":{"cve":"CVE-2021-44228","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","version":"3.1","scorer":"nvd","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2021-44228","sourceDate":"2026-08-11","checkedDate":"2026-10-24"},"epss":{"cve":"CVE-2021-44228","score":0.99999,"percentile":1,"date":"2026-10-23","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2021-44228","checkedDate":"2026-10-24"},"kev":{"cve":"CVE-2021-44228","listed":true,"dateAdded":"2021-12-10","dueDate":"2021-12-24","catalogVersion":"2026.10.23","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","checkedDate":"2026-10-24"},"addedDate":"2026-10-24"},"priority":{"label":"act-now"},"managementSummary":{"what":"Unauthenticated remote code execution in Apache Log4j 2 (CVE-2021-44228), CVSS 10.0. Exploited at internet scale from December 2021 and listed in CISA KEV.","action":"Inventory remaining log4j-core copies and move them to Apache's hardened 2.17.1 / 2.12.4 / 2.3.2 lines."},"seenInTheWild":[{"metric":"scanning","value":1939,"observer":"Shadowserver honeypots","date":"2021-12-14","method":"Honeypot scan/exploit events: 38,638 events from 1,939 unique IPs as of 14 Dec 2021 23:00 UTC","sourceUrl":"https://www.shadowserver.org/news/shadowserver-special-reports-vulnerable-log4j-servers-2021-12-22-update/"},{"metric":"scanning","value":2121,"observer":"Shadowserver honeypots","date":"2021-12-16","method":"69,505 events from 2,121 unique IPs across 332 ports, 11 to 16 Dec 2021 21:00 UTC","sourceUrl":"https://www.shadowserver.org/news/log4j-scanning-and-cve-2021-44228-exploitation-latest-observations-2021-12-16/"},{"metric":"scanning","value":2344,"observer":"Shadowserver honeypots","date":"2021-12-22","method":"174,068 scan/exploit events from 2,344 unique IPs across 433 ports, cumulative to 22 Dec 2021 22:00 UTC","sourceUrl":"https://www.shadowserver.org/news/shadowserver-special-reports-vulnerable-log4j-servers-2021-12-22-update/"},{"metric":"scanning","value":"GreyNoise first observed activity on 9 Dec 2021","observer":"GreyNoise","date":"2021-12-09","method":"First observed activity","sourceUrl":"https://www.greynoise.io/blog/trending-internet-scanning-on-apache-log4j-vulnerability"},{"metric":"scanning","value":453,"observer":"GreyNoise","date":"2025-03-06","method":"Malicious IPs in past 30 days (31 in past 24 hours) as of blog date","sourceUrl":"https://www.greynoise.io/blog/active-exploitation-silk-typhoon-linked-cves"},{"metric":"exploitation-confirmed","value":"Listed","observer":"CISA","date":"2021-12-10","method":"CISA Known Exploited Vulnerabilities catalog dateAdded","sourceUrl":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog"}],"seenInTheWildLinks":[{"title":"Apache Log4j RCE Attempt","url":"https://viz.greynoise.io/tags/apache-log4j-rce-attempt","observer":"GreyNoise","metric":"scanning"},{"title":"Apache Log4j2 JNDI Injection CVE-2021-44228 RCE Check","url":"https://viz.greynoise.io/tags/apache-log4j2-jndi-injection-cve-2021-44228-rce-check","observer":"GreyNoise","metric":"scanning"}],"whatChanged":{"date":"2026-10-24","items":[{"text":"Added Am I affected checks, mitigations and response guidance","section":"am-i-affected"},{"text":"Act-now priority block with sourced CVSS, EPSS, and CISA KEV dates.","section":"priority","addedDate":"2026-10-24"},{"text":"Detection rule coverage table and JSON, IOC CSV, and STIX feeds.","section":"detection","addedDate":"2026-10-24"}]},"whatTheBugIs":"Log4Shell is the public name for CVE-2021-44228 in Apache Log4j 2. Chen Zhaojun of Alibaba Cloud Security Team discovered it. Apache's security page rates it CVSS 3.1 10.0 CRITICAL.\n\nJNDI features used in configurations, log messages, and parameters did not protect against attacker-controlled LDAP and other JNDI endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. Only the log4j-core JAR is impacted; log4j-api alone is not.\n\nApache lists affected versions as [2.0-beta9, 2.3.1) U [2.4, 2.12.2) U [2.13.0, 2.15.0), with initial fixes in 2.3.1, 2.12.2, and 2.15.0. Follow-on issues (CVE-2021-45046, CVE-2021-45105, CVE-2021-44832) led Apache to recommend 2.17.1 (Java 8+), 2.12.4 (Java 7), or 2.3.2 (Java 6) as the hardened line. Cloudflare later reported limited scanning as early as 1 Dec 2021, days before public disclosure.","attackPath":{"caption":"High-level only. Not a reproduction guide.","steps":[{"id":"input","label":"Attacker-controlled string","detail":"A string containing a JNDI lookup reaches an application that logs it with Log4j 2."},{"id":"lookup","label":"Message lookup","detail":"Log4j expands the lookup and contacts an attacker-controlled naming service."},{"id":"load","label":"Remote load","detail":"The JVM may load and execute attacker-supplied code from that endpoint."},{"id":"exec","label":"Code exec","detail":"Remote code runs with the privileges of the logging process. Conceptual impact class only."}]},"exploitation":{"kev":{"listed":true,"date":"2021-12-10","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","note":"CISA KEV entry for CVE-2021-44228, Apache Log4j2 Remote Code Execution Vulnerability. dateAdded 2021-12-10. knownRansomwareCampaignUse Known."},"firstSeen":{"date":"2021-12-01","source":"Cloudflare","note":"Cloudflare reports three instances of attempted exploitation or scanning on 1 Dec 2021, including one at 04:36:50 UTC, before public disclosure."},"vendorStatements":[{"vendor":"Apache Logging Services","date":"2021-12-10","statement":"JNDI lookup can be exploited to execute arbitrary code loaded from an LDAP server. CVSS 3.x Score 10.0 CRITICAL.","url":"https://logging.apache.org/security.html","retracted":false},{"vendor":"Microsoft","date":"2021-12-11","statement":"Microsoft has observed activities including installing coin miners, Cobalt Strike, ransomware (including Khonsari via Minecraft), and nation-state activity from China, Iran, North Korea, and Turkey.","url":"https://www.microsoft.com/en-us/security/blog/2021/12/11/guidance-for-preventing-detecting-and-hunting-for-cve-2021-44228-log4j-2-exploitation/","retracted":false},{"vendor":"CISA","date":"2021-12-17","statement":"CISA issued Emergency Directive (ED) 22-02 directing federal civilian executive branch agencies to address Log4j vulnerabilities.","url":"https://www.cisa.gov/news-events/news/apache-log4j-vulnerability-guidance","retracted":false}]},"timeline":[{"date":"2021-12-01","event":"Cloudflare observes limited scanning and attempted exploitation before public disclosure.","source":{"title":"Exploitation of CVE-2021-44228 before public disclosure","url":"https://blog.cloudflare.com/exploitation-of-cve-2021-44228-before-public-disclosure-and-evolution-of-waf-evasion-patterns/","publisher":"Cloudflare"},"kind":"exploited","key":true},{"date":"2021-12-09","event":"Public discussion of the Log4j 2 JNDI RCE begins; Cloudflare dates broad awareness to 9 Dec 2021.","source":{"title":"Inside the Log4j2 vulnerability (CVE-2021-44228)","url":"https://blog.cloudflare.com/inside-the-log4j2-vulnerability-cve-2021-44228/","publisher":"Cloudflare"},"kind":"disclosure","key":true},{"date":"2021-12-10","event":"NVD publishes CVE-2021-44228. CISA adds it to KEV the same day.","source":{"title":"NVD CVE-2021-44228","url":"https://nvd.nist.gov/vuln/detail/CVE-2021-44228","publisher":"NVD"},"kind":"kev","key":true},{"date":"2021-12-10","event":"Cisco, VMware, Minecraft, and others publish product advisories.","source":{"title":"Vulnerabilities in Apache Log4j Library Affecting Cisco Products","url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-log4j-qRuKNEbd","publisher":"Cisco"},"kind":"vendor","key":true},{"date":"2021-12-10","event":"Public PoC repositories such as kozmer/log4j-shell-poc appear on GitHub.","source":{"title":"log4j-shell-poc","url":"https://github.com/kozmer/log4j-shell-poc","publisher":"kozmer"},"kind":"poc","key":true},{"date":"2021-12-11","event":"Microsoft publishes hunting guidance and confirms coin miners, Cobalt Strike, ransomware, and nation-state use.","source":{"title":"Guidance for preventing, detecting, and hunting for CVE-2021-44228","url":"https://www.microsoft.com/en-us/security/blog/2021/12/11/guidance-for-preventing-detecting-and-hunting-for-cve-2021-44228-log4j-2-exploitation/","publisher":"Microsoft"},"kind":"exploited","key":true},{"date":"2021-12-17","event":"CISA issues Emergency Directive ED 22-02 for federal agencies.","source":{"title":"Apache Log4j Vulnerability Guidance","url":"https://www.cisa.gov/news-events/news/apache-log4j-vulnerability-guidance","publisher":"CISA"},"kind":"advisory","key":true}],"defenderActions":[{"title":"Upgrade Log4j 2","detail":"Move to Apache's hardened releases: 2.17.1 or later (Java 8+), 2.12.4 (Java 7), or 2.3.2 (Java 6). Prefer removing the vulnerable log4j-core JAR over temporary JVM flags.","priority":"now","links":[{"label":"Apache Log4j Security","href":"https://logging.apache.org/security.html"}]},{"title":"Inventory every Log4j 2 copy","detail":"Search application servers, fat JARs, containers, appliances, and vendor products. CISA points to CERT/CC scanners and file-based inventories for CVE-2021-44228.","priority":"now","links":[{"label":"CISA Log4j guidance","href":"https://www.cisa.gov/news-events/news/apache-log4j-vulnerability-guidance"}]},{"title":"Block outbound JNDI-style callbacks where possible","detail":"Restrict egress from application hosts to unexpected LDAP, RMI, and DNS callback destinations while patching rolls out. This is interim only.","priority":"soon"},{"title":"Hunt for post-exploitation","detail":"Microsoft observed coin miners, Cobalt Strike, reverse shells, and ransomware after successful exploitation. Review hosts that ran vulnerable Log4j for persistence and lateral movement.","priority":"soon","links":[{"label":"Microsoft hunting guidance","href":"https://www.microsoft.com/en-us/security/blog/2021/12/11/guidance-for-preventing-detecting-and-hunting-for-cve-2021-44228-log4j-2-exploitation/"}]}],"detection":[{"title":"JNDI lookup strings in requests and logs","detail":"Microsoft describes attacker strings containing jndi followed by protocols such as ldap, ldaps, rmi, dns, iiop, or http. Search web, reverse-proxy, and application logs for those patterns, including obfuscated variants.","logSource":"Web access logs / reverse-proxy logs","kind":"generic","group":"web-proxy"},{"title":"Outbound LDAP / RMI / DNS from app hosts","detail":"Successful exploitation often causes the JVM to contact an attacker-controlled naming service. Alert on unusual outbound LDAP (389/1389), RMI, or newly observed DNS from application tiers.","logSource":"EDR / process telemetry","kind":"generic","group":"edr"},{"title":"Akamai App & API Protector / Kona: rule 3000014","detail":"Akamai updated rule 3000014 (KRS and Adaptive Security Engine) and the AAG Command Injection attack group for CVE-2021-44228 on 2021-12-11. Deny mode recommended.","logSource":"Akamai Security Events (WAF) logs","kind":"vendor-signature","url":"https://www.akamai.com/blog/news/cve-2021-44228-zero-day-vulnerability","date":"2021-12-11"},{"title":"AWS WAF: KnownBadInputs Log4JRCE","detail":"AWSManagedRulesKnownBadInputsRuleSet rule Log4JRCE added 2021-12-10 for CVE-2021-44228. Split into Log4JRCE_HEADER, Log4JRCE_QUERYSTRING, Log4JRCE_URI and Log4JRCE_BODY on 2022-01-28.","logSource":"AWS WAF event logs","kind":"vendor-signature","url":"https://docs.aws.amazon.com/waf/latest/developerguide/aws-managed-rule-groups-changelog.html","date":"2021-12-10"},{"title":"Azure WAF: DRS 944240 / CRS 800100","detail":"Application Gateway WAF managed rules: DRS rule 944240 and CRS 3.x rule 800100 detect Log4j (CVE-2021-44228). Rule reference page has no per-rule date.","logSource":"Azure WAF diagnostic logs (ApplicationGatewayFirewallLog)","kind":"vendor-signature","url":"https://learn.microsoft.com/en-us/azure/web-application-firewall/ag/application-gateway-crs-rulegroups-rules","date":"2026-10-23"},{"title":"Barracuda WAF: attack definitions 1.208 / 1.210 / 1.211","detail":"Attack definition 1.208 (2021-12-13) added CVE-2021-44228 remediation. 1.210 (2021-12-17) and 1.211 (2021-12-18) tightened evasion and exfiltration checks.","logSource":"Barracuda WAF web firewall logs","kind":"vendor-signature","url":"https://updates.cudasvc.com/cgi-bin/view_release_notes.cgi?type=attackdef&version=1.224","date":"2021-12-13"},{"title":"NetScaler WAF signatures: 999077 / 999078 / 999079 / 999080","detail":"NetScaler WAF signature update version 72 added rules 999077-999080 (WEB-MISC Apache Log4j RCE) for CVE-2021-44228; version 73 updated them to also cover CVE-2021-45046.","logSource":"NetScaler WAF (AppFw) logs","kind":"vendor-signature","url":"https://docs.netscaler.com/en-us/citrix-adc/13-1/signature-alerts/signature-update-version-72.html","date":"2026-10-23","dateKind":"checked"},{"title":"Cloudflare WAF Managed Rules: 100514 / 100515 / 100516 / 100517","detail":"Log4J Headers 100514, Log4J Body 100515, Log4J URL 100516, plus 100517 advanced URI and headers rule (disabled by default). Covers CVE-2021-44228 and CVE-2021-45046.","logSource":"Cloudflare Security Events / Firewall events","kind":"vendor-signature","url":"https://blog.cloudflare.com/protection-against-cve-2021-45046-the-additional-log4j-rce-vulnerability/","date":"2021-12-14"},{"title":"F5 attack signatures: 200104768 / 200104769 / 200104772","detail":"JNDI Injection Attempt signatures (Parameter, Header, Content) referencing CVE-2021-44228 in the F5 attack signature reference (last update 2021-12-22). F5 blog of 2021-12-14 confirms nine Log4j signatures for BIG-IP Advanced WAF and ASM.","logSource":"F5 Advanced WAF / Distributed Cloud WAF event logs","kind":"vendor-signature","url":"https://docs.cloud.f5.com/docs-v2/platform/reference/attack-signatures","date":"2021-12-22"},{"title":"Fastly Next-Gen WAF: virtual patch CVE-2021-44228","detail":"Virtual patch CVE-2021-44228 added 2021-12-10. A stricter CVE-2021-44228-STRICT variant followed on 2021-12-11.","logSource":"Fastly Next-Gen WAF signal logs","kind":"vendor-signature","url":"https://www.fastly.com/documentation/reference/changes/2021/12/added-virtual-patch-for-cve-2021-44228/","date":"2021-12-10"},{"title":"Google Cloud Armor: cve-canary 044228 rules","detail":"Preconfigured WAF rule set cve-canary with signatures owasp-crs-v030001-id044228-cve and owasp-crs-v030001-id144228-cve for CVE-2021-44228.","logSource":"Cloud Armor request logs (Cloud Logging)","kind":"vendor-signature","url":"https://cloud.google.com/blog/products/identity-security/cloud-armor-waf-rule-to-help-address-apache-log4j-vulnerability","date":"2021-12-12"},{"title":"Imperva Cloud WAF / WAF Gateway: Log4j rules","detail":"Imperva states existing and updated WAF rules block CVE-2021-44228 attempts. No rule IDs published.","logSource":"WAF event logs","kind":"vendor-signature","url":"https://www.imperva.com/blog/how-were-protecting-customers-staying-ahead-of-cve-2021-44228/","date":"2021-12-11"},{"title":"OWASP CRS: 932130 / 1005 / 932131 / 944140 / 944141","detail":"CRS guidance (2021-12-13) extends rule 932130 to User-Agent and Referer and adds generic rule 1005. Dedicated rules 932131, 944140 (PL1) and 944141 (PL3) came via PR #2349.","logSource":"ModSecurity / Coraza audit logs","kind":"vendor-signature","url":"https://github.com/coreruleset/coreruleset/pull/2349","date":"2022-02-07"},{"title":"Check Point IPS: CPAI-2021-0936","detail":"Protection 'Apache Log4j Remote Code Execution (CVE-2021-44228)', published 2021-12-10.","logSource":"Check Point IPS logs (SmartConsole / Logs & Monitor)","kind":"vendor-signature","url":"https://advisories.checkpoint.com/defense/advisories/public/2021/cpai-2021-0936.html","date":"2021-12-10"},{"title":"Cisco Talos Snort: 1:58722-58733, Snort 3 300055-300057","detail":"Released 2021-12-10 for CVE-2021-44228 (SERVER-OTHER Apache Log4j logging remote code execution attempt). Talos later added more SIDs.","logSource":"Snort / Cisco Secure Firewall IPS event logs","kind":"vendor-signature","url":"https://www.snort.org/advisories/talos-rules-2021-12-10","date":"2021-12-10"},{"title":"Fortinet FortiGuard IPS / FortiWeb signatures","detail":"Fortinet released IPS signature Apache.Log4j.Error.Log.Remote.Code.Execution (VID 51006) in IPS package 19.215, plus web application signatures in database 0.00301 / 0.00305.","logSource":"WAF / IPS event logs","kind":"vendor-signature","url":"https://www.fortiguard.com/outbreak-alert/log4j2-vulnerability","date":"2026-10-23","dateKind":"checked"},{"title":"Juniper IDP: HTTP:APACHE:LOG4J-JNDI-MGNR-RCE","detail":"IDP signature for CVE-2021-44228 / CVE-2021-45046, release date 2021-12-11, recommended action Drop.","logSource":"Juniper SRX IDP logs","kind":"vendor-signature","url":"https://www.juniper.net/us/en/threatlabs/ips-signatures/detail.HTTP:APACHE:LOG4J-JNDI-MGNR-RCE.html","date":"2021-12-11"},{"title":"Palo Alto Networks Threat Prevention: 91991 / 91994 / 91995 / 92001 / 92007 / 92012","detail":"Threat IDs for CVE-2021-44228 per Unit 42, starting with content 8506.","logSource":"Palo Alto Networks threat logs (Threat Prevention / NGFW)","kind":"vendor-signature","url":"https://unit42.paloaltonetworks.com/apache-log4j-vulnerability-cve-2021-44228/","date":"2021-12-10"},{"title":"Sophos Firewall IPS: Log4j second-stage signature 59218","detail":"IPS release 18.24.96 (2026-06-03) lists 'LDAP Serialized Java Data Content Response - Inbound (Possible CVE-2021-44228 Second Stage)'. Older Sophos IPS notes for 2021 are not online.","logSource":"Sophos Firewall IPS logs","kind":"vendor-signature","url":"https://docs.sophos.com/releasenotes/output/en-us/nsg/IPSReleaseNotes/18.24.96.html","date":"2026-06-03"},{"title":"Trend Micro Deep Security 1011241 / 1011242, TippingPoint 40627","detail":"Deep Security IPS rules 1011241 and 1011242 (Apache Log4j RCE, CVE-2021-44228). TippingPoint filter 40627 'HTTP: JNDI Injection in HTTP Request' per SB#1091.","logSource":"Trend Micro Deep Security / TippingPoint SMS event logs","kind":"vendor-signature","url":"https://success.trendmicro.com/en-US/solution/KA-0012652","date":"2021-12-16","dateKind":"checked"},{"title":"Cato IPS: CVE-2021-44228 virtual patch","detail":"Cato IPS virtual patch. Opt-in protection 2021-12-11, global protection 2021-12-11. No rule ID published.","logSource":"Cato Networks IPS events","kind":"vendor-signature","url":"https://www.catonetworks.com/rapid-cve-mitigation/","date":"2026-10-23","dateKind":"checked"},{"title":"Netskope IPS: 59246, 58722-58795 (19 SIDs)","detail":"Netskope Threat Labs IPS library lists SERVER-WEBAPP 59246 and SERVER-OTHER 58722-58795 for CVE-2021-44228. Library pages are undated.","logSource":"Netskope Cloud Firewall / IPS alert logs","kind":"vendor-signature","url":"https://threatlabs.netskope.com/library/ips/server-webapp-apache-log4j-logging-remote-code-execution-attempt/","date":"2026-10-23","dateKind":"checked"},{"title":"Zscaler ATP / Sandbox: Apache.Exploit.CVE-2021-44228","detail":"Advanced Threat Protection and Cloud Sandbox signature Apache.Exploit.CVE-2021-44228.","logSource":"Zscaler ZIA web / threat logs","kind":"vendor-signature","url":"https://www.zscaler.com/blogs/security-research/security-advisory-log4j-0-day-remote-code-execution-vulnerability-cve-2021","date":"2021-12-11"}],"detectionRules":[{"id":"sigma-log4j-generic-web","title":"Log4j RCE CVE-2021-44228 Generic","language":"sigma","query":"title: Log4j RCE CVE-2021-44228 Generic\nid: 5ea8faa8-db8b-45be-89b0-151b84c82702\nstatus: test\ndescription: Detects exploitation attempt against log4j RCE vulnerability reported as CVE-2021-44228 (Log4Shell)\nreferences:\n    - https://web.archive.org/web/20231230220738/https://www.lunasec.io/docs/blog/log4j-zero-day/\n    - https://news.ycombinator.com/item?id=29504755\n    - https://github.com/tangxiaofeng7/apache-log4j-poc\n    - https://gist.github.com/Neo23x0/e4c8b03ff8cdf1fa63b7d15db6e3860b\n    - https://github.com/YfryTchsGD/Log4jAttackSurface\n    - https://twitter.com/shutingrz/status/1469255861394866177?s=21\nauthor: Florian Roth (Nextron Systems)\ndate: 2021-12-10\nmodified: 2022-02-06\ntags:\n    - attack.initial-access\n    - attack.t1190\n    - detection.emerging-threats\nlogsource:\n    category: webserver\ndetection:\n    keywords:\n        - '${jndi:ldap:/'\n        - '${jndi:rmi:/'\n        - '${jndi:ldaps:/'\n        - '${jndi:dns:/'\n        - '/$%7bjndi:'\n        - '%24%7bjndi:'\n        - '$%7Bjndi:'\n        - '%2524%257Bjndi'\n        - '%2F%252524%25257Bjndi%3A'\n        - '${jndi:${lower:'\n        - '${::-j}${'\n        - '${jndi:nis'\n        - '${jndi:nds'\n        - '${jndi:corba'\n        - '${jndi:iiop'\n        - 'Reference Class Name: foo'\n        - '${${env:BARFOO:-j}'\n        - '${::-l}${::-d}${::-a}${::-p}'\n        - '${base64:JHtqbmRp'\n        - '${${env:ENV_NAME:-j}ndi${env:ENV_NAME:-:}$'\n        - '${${lower:j}ndi:'\n        - '${${upper:j}ndi:'\n        - '${${::-j}${::-n}${::-d}${::-i}:'\n    filter:\n        - 'w.nessus.org/nessus'\n        - '/nessus}'\n    condition: keywords and not filter\nfalsepositives:\n    - Vulnerability scanning\nlevel: high","logSource":"Web access logs / reverse-proxy logs","author":"Florian Roth (Nextron Systems)","authorUrl":"https://github.com/SigmaHQ/sigma","sourceUrl":"https://github.com/SigmaHQ/sigma/blob/05d1031f537e830b76da53bae2400c5814c89165/rules-emerging-threats/2021/Exploits/CVE-2021-44228/web_cve_2021_44228_log4j.yml","sourceDate":"2022-02-06","license":"DRL-1.1","origin":"community","tested":"untested"},{"id":"sigma-jvm-jndi-injection","title":"Potential JNDI Injection Exploitation In JVM Based Application","language":"sigma","query":"title: Potential JNDI Injection Exploitation In JVM Based Application\nid: bb0e9cec-d4da-46f5-997f-22efc59f3dca\nstatus: test\ndescription: Detects potential JNDI Injection exploitation. Often coupled with Log4Shell exploitation.\nreferences:\n    - https://www.wix.engineering/post/threat-and-vulnerability-hunting-with-application-server-error-logs\n    - https://secariolabs.com/research/analysing-and-reproducing-poc-for-log4j-2-15-0\nauthor: Moti Harmats\ndate: 2023-02-11\ntags:\n    - attack.initial-access\n    - attack.t1190\nlogsource:\n    category: application\n    product: jvm\n    definition: 'Requirements: application error logs must be collected (with LOG_LEVEL=ERROR and above)'\ndetection:\n    keywords:\n        - 'com.sun.jndi.ldap.'\n        - 'org.apache.logging.log4j.core.net.JndiManager'\n    condition: keywords\nfalsepositives:\n    - Application bugs\nlevel: high","logSource":"JVM application error logs","author":"Moti Harmats","authorUrl":"https://github.com/SigmaHQ/sigma","sourceUrl":"https://github.com/SigmaHQ/sigma/blob/05d1031f537e830b76da53bae2400c5814c89165/rules/application/jvm/java_jndi_injection_exploitation_attempt.yml","sourceDate":"2023-02-11","license":"DRL-1.1","origin":"community","tested":"untested"},{"id":"splunk-log4shell-jndi-payload","title":"Log4Shell JNDI Payload Injection Attempt","language":"spl","query":"| from datamodel Web.Web\n| regex _raw=\"[jJnNdDiI]{4}(\\:|\\%3A|\\/|\\%2F)\\w+(\\:\\/\\/|\\%3A\\%2F\\%2F)(\\$\\{.*?\\}(\\.)?)?\"\n| fillnull\n| stats count by action, category, dest, dest_port, http_content_type, http_method, http_referrer, http_user_agent, site, src, url, url_domain, user\n| `log4shell_jndi_payload_injection_attempt_filter`","logSource":"Web data model (Nginx or other access logs)","author":"Jose Hernandez","authorUrl":"https://research.splunk.com/","sourceUrl":"https://github.com/splunk/security_content/blob/7aafb1e3bc6bbe2b49bcf7d4fed029a5ea7e871c/detections/web/log4shell_jndi_payload_injection_attempt.yml","sourceDate":"2026-09-08","license":"Apache-2.0","origin":"vendor","notes":"Uses Splunk ES macros and data models from splunk/security_content; the trailing _filter macro is a tuning hook.","tested":"tested","testedNote":"Splunk security_content YAML includes a True Positive Test and status production.","testedSourceUrl":"https://github.com/splunk/security_content/blob/7aafb1e3bc6bbe2b49bcf7d4fed029a5ea7e871c/detections/web/log4shell_jndi_payload_injection_attempt.yml"},{"id":"splunk-java-outbound-ldap-ports","title":"Outbound Network Connection from Java Using Default Ports","language":"spl","query":"| tstats `security_content_summariesonly` count\nFROM datamodel=Endpoint.Processes WHERE\n\nProcesses.process_name IN (\n    \"java.exe\",\n    \"javaw.exe\"\n)\nBY Processes.action Processes.dest Processes.original_file_name\n   Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid\n   Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path\n   Processes.process Processes.process_exec Processes.process_guid\n   Processes.process_hash Processes.process_id Processes.process_integrity_level\n   Processes.process_name Processes.process_path Processes.user\n   Processes.user_id Processes.vendor_product\n\n| `drop_dm_object_name(Processes)`\n| `security_content_ctime(firstTime)`\n| `security_content_ctime(lastTime)`\n| join process_id dest\n[\n    | tstats `security_content_summariesonly` count\n    FROM datamodel=Network_Traffic.All_Traffic WHERE\n    All_Traffic.dest_port IN (\n                389,\n                636,\n                1099,\n                1389\n    )\n    BY All_Traffic.action All_Traffic.app All_Traffic.bytes\n        All_Traffic.bytes_in All_Traffic.bytes_out All_Traffic.dest\n        All_Traffic.dest_ip All_Traffic.dest_port All_Traffic.dvc\n        All_Traffic.protocol All_Traffic.protocol_version All_Traffic.src\n        All_Traffic.src_ip All_Traffic.src_port All_Traffic.transport\n        All_Traffic.user All_Traffic.vendor_product All_Traffic.direction\n        All_Traffic.process_id\n    | `drop_dm_object_name(All_Traffic)`\n    | rename dest as connection_to_CNC\n    | rename src as dest\n]\n| table _time dest\n        parent_process_path parent_process_name parent_process\n        process_path process_name process process_hash\n        connection_to_CNC dest_port user\n| `outbound_network_connection_from_java_using_default_ports_filter`","logSource":"Sysmon EventID 1 and 3 (Endpoint and Network_Traffic data models)","author":"Mauricio Velazco, Lou Stella, Splunk","authorUrl":"https://research.splunk.com/","sourceUrl":"https://github.com/splunk/security_content/blob/7aafb1e3bc6bbe2b49bcf7d4fed029a5ea7e871c/detections/endpoint/outbound_network_connection_from_java_using_default_ports.yml","sourceDate":"2026-05-13","license":"Apache-2.0","origin":"vendor","notes":"Uses Splunk ES macros and data models from splunk/security_content; the trailing _filter macro is a tuning hook.","tested":"tested","testedNote":"Splunk security_content YAML includes a True Positive Test and status production.","testedSourceUrl":"https://github.com/splunk/security_content/blob/7aafb1e3bc6bbe2b49bcf7d4fed029a5ea7e871c/detections/endpoint/outbound_network_connection_from_java_using_default_ports.yml"},{"id":"sentinel-log4j-user-agent","title":"User agent search for log4j exploitation attempt","language":"kql","query":"let UserAgentString = dynamic ([\"${jndi:ldap:/\", \"${jndi:rmi:/\", \"${jndi:ldaps:/\", \"${jndi:dns:/\", \"${jndi:iiop:/\",\"${jndi:\",\"${jndi:nds:/\",\"${jndi:corba/\"]);\nlet UARegexMinimalString=dynamic(['{','%7b', '%7B']);\nlet UARegex = @'(\\\\$|%24)(\\\\{|%7B)([^jJ]*[jJ])([^nN]*[nN])([^dD]*[dD])([^iI]*[iI])(:|%3A|\\\\$|%24|}|%7D)';\n(union isfuzzy=true\n(OfficeActivity\n| where UserAgent has_any (UserAgentString) or UserAgent matches regex UARegex\n| summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated) by UserAgent, SourceIP = ClientIP, Account = UserId, Type, Operation\n),\n(AzureDiagnostics\n| where Category in (\"FrontdoorWebApplicationFirewallLog\", \"FrontdoorAccessLog\", \"ApplicationGatewayFirewallLog\", \"ApplicationGatewayAccessLog\")\n| where userAgent_s has_any (UserAgentString) or userAgent_s matches regex UARegex\n| summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated) by UserAgent = userAgent_s, SourceIP = column_ifexists(\"clientIp_s\",clientIP_s), Type, column_ifexists(\"originalHost_s\",host_s), Url = requestUri_s, HttpStatus = column_ifexists(\"httpStatusDetails_s\",httpStatus_d), column_ifexists(\"trackingReference_s\",transactionId_g), ruleName_s, ResourceType, ResourceId\n),\n(\nW3CIISLog\n| where csUserAgent has_any (UserAgentString) or csUserAgent matches regex UARegex\n| summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated) by UserAgent = csUserAgent, SourceIP = cIP, Account = csUserName, Type, sSiteName, csMethod, Url = csUriStem\n),\n(\nAWSCloudTrail\n| where UserAgent has_any (UserAgentString) or UserAgent matches regex UARegex\n| summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated) by UserAgent, SourceIP = SourceIpAddress, Account = UserIdentityUserName, Type, EventName\n),\n(SigninLogs\n| where UserAgent has_any (UserAgentString) or UserAgent matches regex UARegex\n| summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated) by UserAgent, SourceIP = IPAddress, Account = UserPrincipalName, Type, Operation = OperationName, tostring(LocationDetails), tostring(DeviceDetail),    AppDisplayName, ClientAppUsed\n),\n(AADNonInteractiveUserSignInLogs \n| where UserAgent has_any (UserAgentString) or UserAgent matches regex UARegex\n| summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated) by UserAgent, SourceIP = IPAddress, Account = UserPrincipalName, Type, Operation = OperationName, tostring(LocationDetails), tostring(DeviceDetail), AppDisplayName, ClientAppUsed\n),\n(_Im_WebSession (httpuseragent_has_any=array_concat(UserAgentString,UARegexMinimalString))\n| where HttpUserAgent has_any (UserAgentString) or HttpUserAgent matches regex UARegex\n| summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated) by HttpUserAgent, SourceIP = SrcIpAddr, DstIpAddr, Account = SrcUsername, Url, Type\n)\n)","logSource":"IIS, WAF, proxy, Office 365, Entra ID and AWS logs in Microsoft Sentinel","author":"Microsoft Sentinel community (Azure/Azure-Sentinel)","authorUrl":"https://github.com/Azure/Azure-Sentinel","sourceUrl":"https://github.com/Azure/Azure-Sentinel/blob/464951510c3f4a9a35fa36e71fb4e9c969cd84db/Solutions/Apache%20Log4j%20Vulnerability%20Detection/Analytic%20Rules/UserAgentSearch_log4j.yaml","sourceDate":"2025-01-21","license":"MIT","origin":"vendor","tested":"untested"},{"id":"elastic-java-service-exploitation","title":"Potential Java Service Exploitation via Suspicious Child Process","language":"eql","query":"sequence by host.id with maxspan=5s\n [network where event.action == \"connection_accepted\" and network.direction == \"ingress\" and\n\n  process.name : \"java\" and\n  destination.port < 49152  and source.port >= 32768] by process.pid\n [process where event.type == \"start\" and\n\n  /* Suspicious JAVA child process */\n  process.parent.name : \"java\" and\n  process.name : (\n    \"sh\", \"bash\", \"dash\", \"ksh\", \"tcsh\", \"zsh\", \"ash\",  \"mksh\", \"busybox\",\n    \"curl\", \"wget\", \"perl*\", \"python*\", \"ruby*\", \"php*\", \"lua*\", \"socat\",\n    \"nc\", \"ncat\", \"netcat\", \"netcat.openbsd\", \"netcat.traditional\", \"nc.openbsd\",\n    \"nc.traditional\", \"nohup\", \"setsid\", \"disown\", \"hostname\", \"whoami\", \"id\"\n  ) and\n    not process.command_line like~ (\n      \"bash -c ulimit -u\",\n      \"bash /opt/flutter/bin/flutter*\",\n      \"bash -c echo $$\",\n      \"/bin/bash /opt/python3/bin/jira*\",\n      \"/bin/sh -c env LC_ALL=C /usr/sbin/lpc status*\"\n    )] by process.parent.pid","logSource":"Linux network and process events (Elastic Defend / Auditbeat)","author":"Elastic","authorUrl":"https://github.com/elastic/detection-rules","sourceUrl":"https://github.com/elastic/detection-rules/blob/1b18e9c958f104a3cb049c565a216436deba272f/rules/cross-platform/execution_suspicious_java_netcon_childproc.toml","sourceDate":"2026-09-18","license":"Elastic License 2.0","origin":"vendor","tested":"untested"},{"id":"et-log4j-rce-http-ldap","title":"ET EXPLOIT Apache log4j RCE Attempt (http ldap) (CVE-2021-44228)","language":"suricata","query":"alert http any any -> [$HOME_NET,$HTTP_SERVERS] any (msg:\"ET EXPLOIT Apache log4j RCE Attempt (http ldap) (CVE-2021-44228)\"; flow:established,to_server; content:\"|24 7b|jndi|3a|ldap|3a 2f 2f|\"; nocase; fast_pattern; reference:url,lunasec.io/docs/blog/log4j-zero-day/; reference:cve,2021-44228; classtype:attempted-admin; sid:2034647; rev:1; metadata:attack_target Server, created_at 2021_12_10, cve CVE_2021_44228, deployment Perimeter, deployment Internal, confidence High, signature_severity Major, tag Exploit, tag CISA_KEV, updated_at 2021_12_10, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1190, mitre_technique_name Exploit_Public_Facing_Application;)","logSource":"Suricata IDS alerts (ET Open ruleset)","author":"Emerging Threats (Proofpoint)","authorUrl":"https://rules.emergingthreats.net/","sourceUrl":"https://rules.emergingthreats.net/open/suricata-7.0.3/rules/emerging-exploit.rules","sourceDate":"2021-12-10","license":"BSD-3-Clause (ET Open, sids 2000000-2799999)","origin":"vendor","tested":"untested"},{"id":"v2s-logscale-java-spawns-shell","title":"Java process spawns a shell or downloader (Falcon)","language":"logscale","query":"#event_simpleName=ProcessRollup2 event_platform=Lin\n| ParentBaseFileName=java\n| FileName=/^(sh|bash|dash|curl|wget)$/i\n| groupBy([aid, ComputerName, FileName, CommandLine], limit=max)","logSource":"CrowdStrike Falcon ProcessRollup2 (Linux)","author":"vuln2shell","authorUrl":"https://vuln2shell.com","sourceUrl":"https://github.com/elastic/detection-rules/blob/1b18e9c958f104a3cb049c565a216436deba272f/rules/cross-platform/execution_suspicious_java_netcon_childproc.toml","sourceDate":"2026-09-18","license":"CC0 1.0","origin":"vuln2shell","notes":"Falcon port of the child-process half of Elastic's Log4Shell-era Java service exploitation rule (no network sequence). Baseline Java apps that shell out.","tested":"untested"}],"detectionLinks":[{"title":"Microsoft: Guidance for preventing, detecting, and hunting for CVE-2021-44228","url":"https://www.microsoft.com/en-us/security/blog/2021/12/11/guidance-for-preventing-detecting-and-hunting-for-cve-2021-44228-log4j-2-exploitation/","author":"Microsoft","date":"2021-12-11","note":"Many Defender and Sentinel queries."},{"title":"Florian Roth: Log4Shell detection gist (grep and regex)","url":"https://gist.github.com/Neo23x0/e4c8b03ff8cdf1fa63b7d15db6e3860b","author":"Florian Roth"},{"title":"Splunk: Hunting for Log4Shell","url":"https://github.com/splunk/security_content/blob/7aafb1e3bc6bbe2b49bcf7d4fed029a5ea7e871c/detections/web/hunting_for_log4shell.yml","author":"Splunk Threat Research Team"},{"title":"Azure Sentinel: Malicious Connection to LDAP port for CVE-2021-44228","url":"https://github.com/Azure/Azure-Sentinel/blob/464951510c3f4a9a35fa36e71fb4e9c969cd84db/Solutions/Apache%20Log4j%20Vulnerability%20Detection/Hunting%20Queries/NetworkConnectionldap_log4j.yaml","author":"Microsoft Sentinel community","date":"2024-01-03"},{"title":"signature-base: Log4j YARA rules","url":"https://github.com/Neo23x0/signature-base/blob/3ce6640c26046da8e6d8094af3eaaee3ee84e648/yara/expl_log4j_cve_2021_44228.yar","author":"Florian Roth","date":"2021-12-12"},{"title":"Cloudflare: Exploitation of Log4j before public disclosure and WAF evasion patterns","url":"https://blog.cloudflare.com/exploitation-of-cve-2021-44228-before-public-disclosure-and-evolution-of-waf-evasion-patterns/","author":"Cloudflare","date":"2021-12-14"}],"retrohunt":{"summary":"Search back to 1 Dec 2021 for JNDI lookup strings reaching anything that logs with Log4j 2, then check whether those hosts made outbound LDAP, RMI or DNS callbacks or started shells.","lookback":{"from":"2021-12-01","basis":"first-attempt","rationale":"Cloudflare saw attempted exploitation on 1 Dec 2021 (earliest 04:36:50 UTC), eight days before public disclosure. First-seen dates are lower bounds, so search further back if your logs allow. Most teams will not have raw web logs from 2021; focus on persistent artefacts on hosts that ran a vulnerable Log4j 2.","sources":[{"url":"https://blog.cloudflare.com/exploitation-of-cve-2021-44228-before-public-disclosure-and-evolution-of-waf-evasion-patterns/","date":"2021-12-14","publisher":"Cloudflare"}]},"logSources":[{"name":"Web server, reverse-proxy and WAF logs","why":"Exploit strings arrive in URLs, headers (User-Agent, X-Api-Version, Referer) and form fields.","required":true},{"name":"Application logs written by Log4j","why":"The payload is often logged verbatim by the vulnerable application itself.","required":true},{"name":"DNS resolver logs","why":"JNDI callbacks and dns: probes resolve attacker domains.","required":true},{"name":"Firewall / NetFlow egress logs","why":"Successful lookups open outbound LDAP (389/1389/636), RMI (1099) or HTTP to the attacker.","required":true},{"name":"EDR process telemetry","why":"Post-exploitation shows java spawning sh, bash, curl, wget, cmd or powershell.","required":false}],"steps":[{"title":"List every host that ran a vulnerable Log4j 2 during the window","detail":"Use your SBOM, scanner history or CISA's list of scanners. Hosts that were never vulnerable can be skipped.","sources":[{"url":"https://www.cisa.gov/news-events/news/apache-log4j-vulnerability-guidance","date":"2021-12-17","publisher":"CISA"}]},{"title":"Search request and application logs for JNDI lookups","detail":"Look for jndi: followed by ldap, ldaps, rmi, dns, iiop or http, including nested ${...} obfuscation such as ${lower:j} or ${::-j}. Normalise URL encoding first.","sources":[{"url":"https://www.microsoft.com/en-us/security/blog/2021/12/11/guidance-for-preventing-detecting-and-hunting-for-cve-2021-44228-log4j-2-exploitation/","date":"2021-12-11","publisher":"Microsoft"}]},{"title":"Pivot to egress from the same hosts","detail":"For each hit, look for outbound LDAP, RMI or unusual DNS from that host within minutes. A callback means the lookup ran.","sources":[{"url":"https://www.microsoft.com/en-us/security/blog/2021/12/11/guidance-for-preventing-detecting-and-hunting-for-cve-2021-44228-log4j-2-exploitation/","date":"2021-12-11","publisher":"Microsoft"}]},{"title":"Check for java child processes and new persistence","detail":"Microsoft saw coin miners, Cobalt Strike, reverse shells and ransomware after exploitation. Review java child processes, cron, services and new accounts on hit hosts.","sources":[{"url":"https://www.microsoft.com/en-us/security/blog/2021/12/11/guidance-for-preventing-detecting-and-hunting-for-cve-2021-44228-log4j-2-exploitation/","date":"2021-12-11","publisher":"Microsoft"}]}],"queries":[{"id":"v2s-rh-spl-log4shell-jndi","title":"JNDI lookup strings in web logs since 1 Dec 2021","language":"spl","query":"index=* (sourcetype=access_combined OR sourcetype=nginx* OR sourcetype=iis OR sourcetype=apache*) earliest=\"12/01/2021:00:00:00\"\n| eval raw=lower(urldecode(_raw))\n| regex raw=\"\\$\\{.{0,30}j.{0,30}n.{0,30}d.{0,30}i.{0,30}:\"\n| stats count min(_time) as firstTime max(_time) as lastTime values(uri) as uri by host, clientip\n| convert ctime(firstTime) ctime(lastTime)","logSource":"Web access / proxy logs in Splunk","author":"vuln2shell","authorUrl":"https://vuln2shell.com","sourceUrl":"https://www.microsoft.com/en-us/security/blog/2021/12/11/guidance-for-preventing-detecting-and-hunting-for-cve-2021-44228-log4j-2-exploitation/","sourceDate":"2021-12-11","license":"CC0 1.0","origin":"vuln2shell","notes":"Loose regex to catch common ${lower:j}-style obfuscation. Expect scanner noise; hits are attempts until a callback or process event confirms.","tested":"untested","timeRange":"From 2021-12-01 to today"},{"id":"v2s-rh-kql-log4shell-java-ldap-egress","title":"Outbound LDAP or RMI from java since 1 Dec 2021","language":"kql","query":"DeviceNetworkEvents\n| where Timestamp >= datetime(2021-12-01)\n| where InitiatingProcessFileName in~ (\"java\", \"java.exe\", \"javaw.exe\")\n| where RemotePort in (389, 636, 1389, 1099, 3268)\n| where RemoteIPType == \"Public\"\n| summarize Count = count(), FirstSeen = min(Timestamp), LastSeen = max(Timestamp) by DeviceName, RemoteIP, RemotePort","logSource":"Microsoft Defender for Endpoint DeviceNetworkEvents","author":"vuln2shell","authorUrl":"https://vuln2shell.com","sourceUrl":"https://www.microsoft.com/en-us/security/blog/2021/12/11/guidance-for-preventing-detecting-and-hunting-for-cve-2021-44228-log4j-2-exploitation/","sourceDate":"2021-12-11","license":"CC0 1.0","origin":"vuln2shell","notes":"Defender advanced hunting keeps 30 days by default; older data needs Sentinel or another archive.","tested":"untested","timeRange":"From 2021-12-01, limited by retention"},{"id":"v2s-rh-logscale-log4shell-jndi","title":"JNDI lookup strings in any ingested log","language":"logscale","query":"// Set the time picker to start 2021-12-01, or as far back as retention allows\n/\\$\\{[^}]{0,40}j[^}]{0,40}n[^}]{0,40}d[^}]{0,40}i/i\n| groupBy([#host, #type], function=[count(), min(@timestamp, as=firstSeen), max(@timestamp, as=lastSeen)])","logSource":"Any web, proxy or application logs in LogScale","author":"vuln2shell","authorUrl":"https://vuln2shell.com","sourceUrl":"https://www.microsoft.com/en-us/security/blog/2021/12/11/guidance-for-preventing-detecting-and-hunting-for-cve-2021-44228-log4j-2-exploitation/","sourceDate":"2021-12-11","license":"CC0 1.0","origin":"vuln2shell","notes":"Same loose pattern as the SPL query.","tested":"untested","timeRange":"From 2021-12-01"}],"thirdPartyQueries":[{"title":"Microsoft advanced hunting queries for CVE-2021-44228","url":"https://www.microsoft.com/en-us/security/blog/2021/12/11/guidance-for-preventing-detecting-and-hunting-for-cve-2021-44228-log4j-2-exploitation/","author":"Microsoft","date":"2021-12-11","language":"kql","license":"see source","origin":"vendor","note":"Hunting queries in the blog post."},{"title":"Hunting for Log4Shell","url":"https://github.com/splunk/security_content/blob/7aafb1e3bc6bbe2b49bcf7d4fed029a5ea7e871c/detections/web/hunting_for_log4shell.yml","author":"Splunk Threat Research","date":"2021-12-14","language":"spl","license":"Apache-2.0","origin":"vendor","note":"Already linked from Detection."},{"title":"Log4Shell detection grep and regex","url":"https://gist.github.com/Neo23x0/e4c8b03ff8cdf1fa63b7d15db6e3860b","author":"Florian Roth","date":null,"language":"grep","license":"see source","origin":"vendor","note":"Greps compressed and rotated logs on disk; useful when logs never reached the SIEM."}],"artefacts":[{"kind":"web-log","value":"${jndi:ldap:// , ${jndi:rmi:// , ${jndi:dns:// and obfuscated forms","detail":"Exploit strings in requests or application logs.","sourceUrl":"https://www.microsoft.com/en-us/security/blog/2021/12/11/guidance-for-preventing-detecting-and-hunting-for-cve-2021-44228-log4j-2-exploitation/","sourceDate":"2021-12-11"},{"kind":"network","value":"Outbound LDAP, RMI or DNS from application hosts","detail":"A callback right after a logged payload means the JNDI lookup ran.","sourceUrl":"https://www.microsoft.com/en-us/security/blog/2021/12/11/guidance-for-preventing-detecting-and-hunting-for-cve-2021-44228-log4j-2-exploitation/","sourceDate":"2021-12-11"},{"kind":"process","value":"java spawning sh, bash, curl, wget, cmd.exe or powershell.exe","detail":"Post-exploitation command execution.","sourceUrl":"https://www.microsoft.com/en-us/security/blog/2021/12/11/guidance-for-preventing-detecting-and-hunting-for-cve-2021-44228-log4j-2-exploitation/","sourceDate":"2021-12-11"}],"iocs":[],"iocNote":"No fixed IOC list: payloads and callback hosts were too varied. Use the JNDI pattern and egress pivots instead.","hitMeaning":[{"level":"attempt","detail":"A JNDI string in a request only shows that someone tried. Most hits are scanners."},{"level":"likely-compromise","detail":"A JNDI string followed by outbound LDAP, RMI or DNS to the same attacker host from the logging server."},{"level":"confirmed-compromise","detail":"A java child process, downloaded payload or new persistence on that host after the callback."}],"nextSteps":[{"title":"Isolate and scope","detail":"Isolate hosts with a callback, collect memory and disk, and review lateral movement from them.","links":[{"label":"Microsoft guidance","href":"https://www.microsoft.com/en-us/security/blog/2021/12/11/guidance-for-preventing-detecting-and-hunting-for-cve-2021-44228-log4j-2-exploitation/"}]},{"title":"Rotate secrets","detail":"Treat credentials and keys readable by the Java process as exposed."},{"title":"Confirm the fix","detail":"Verify log4j-core 2.17.1 or later (or the Java 6/7 lines) is the only copy on the host.","links":[{"label":"Apache Log4j security","href":"https://logging.apache.org/security.html"}]}],"limits":["Raw web logs from 2021 are rarely retained. Persistent artefacts and backups are the main evidence now.","Obfuscated payloads can evade simple string searches; decode before matching."],"sources":[{"url":"https://blog.cloudflare.com/exploitation-of-cve-2021-44228-before-public-disclosure-and-evolution-of-waf-evasion-patterns/","date":"2021-12-14","publisher":"Cloudflare"},{"url":"https://www.microsoft.com/en-us/security/blog/2021/12/11/guidance-for-preventing-detecting-and-hunting-for-cve-2021-44228-log4j-2-exploitation/","date":"2021-12-11","publisher":"Microsoft"},{"url":"https://www.cisa.gov/news-events/news/apache-log4j-vulnerability-guidance","date":"2021-12-17","publisher":"CISA"}],"updatedAt":"2026-10-24"},"amIAffected":{"summary":"CVE-2021-44228 is JNDI lookup RCE in Apache Log4j 2 log4j-core. Affected: [2.0-beta9, 2.3.1) U [2.4, 2.12.2) U [2.13.0, 2.15.0). First fixes: 2.3.1 (Java 6), 2.12.2 (Java 7), 2.15.0 (Java 8+). Follow-on CVEs (45046, 45105, 44832) make 2.17.1 / 2.12.4 / 2.3.2 the hardened line on the catalog page. log4j-api alone is not impacted per Apache.","checks":[{"id":"v2s-aia-log4shell-package-1","kind":"package","title":"Find log4j-core JARs and read pom.properties","detail":"Microsoft TVM: identify log4j-core by META-INF/maven/org.apache.logging.log4j/log4j-core/pom.properties and by paths containing /log4j/core/lookup/JndiLookup.class. Also search nested JARs under lib/, WEB-INF/lib/, App-INF/lib/. CISA pointed to CERT/CC scanners and file-based inventories.","command":"find / -name 'log4j-core*.jar' 2>/dev/null; find / -path '*log4j/core/lookup/JndiLookup.class' 2>/dev/null","affectedMeans":"log4j-core version in pom.properties is 2.0-beta9 through 2.14.1 (except the first Java 6/7 fixes 2.3.1 / 2.12.2), or JndiLookup.class is present in an unpatched 2.x core JAR. Prefer treating anything below 2.17.1 / 2.12.4 / 2.3.2 as still needing the hardened line because of follow-on CVEs.","fixedMeans":"Every log4j-core copy is 2.17.1 or later (Java 8+), 2.12.4 (Java 7), or 2.3.2 (Java 6), or the deployment uses only log4j-api with no log4j-core (Apache: not impacted by CVE-2021-44228).","notes":"Uber-JARs hide nested copies. Microsoft added Uber-JAR discovery on 20 Jan 2022. Devices that never ran log4j-core can be skipped.","sources":[{"url":"https://logging.apache.org/security.html","date":"2021-12-10","publisher":"Apache Logging Services"},{"url":"https://www.microsoft.com/en-us/security/blog/2021/12/11/guidance-for-preventing-detecting-and-hunting-for-cve-2021-44228-log4j-2-exploitation/","date":"2021-12-11","publisher":"Microsoft"},{"url":"https://www.cisa.gov/news-events/news/apache-log4j-vulnerability-guidance","date":"2021-12-17","publisher":"CISA"}]},{"id":"v2s-aia-log4shell-version-2","kind":"version","title":"Query vulnerability-management inventory for CVE-2021-44228","detail":"Microsoft published DeviceTvmSoftwareVulnerabilities filtered on CVE-2021-44228 and CVE-2021-45046, plus DeviceTvmSoftwareEvidenceBeta disk paths containing log4j.","command":"DeviceTvmSoftwareVulnerabilities | where CveId in (\"CVE-2021-44228\", \"CVE-2021-45046\")","affectedMeans":"A device row lists those CVEs, or evidence paths contain a vulnerable log4j-core version.","fixedMeans":"No remaining rows after upgrade, or remaining log4j-core versions are the hardened line (2.17.1+ / 2.12.4 / 2.3.2).","notes":"Coverage depends on the scanner seeing nested JARs. Vendor appliances need the vendor advisory, not only a host JAR search.","sources":[{"url":"https://www.microsoft.com/en-us/security/blog/2021/12/11/guidance-for-preventing-detecting-and-hunting-for-cve-2021-44228-log4j-2-exploitation/","date":"2021-12-11","publisher":"Microsoft"}]},{"id":"v2s-aia-log4shell-config-3","kind":"config","title":"See whether message lookups were still enabled on leftover 2.10-2.14 copies","detail":"Microsoft documented LOG4J_FORMAT_MSG_NO_LOOKUPS as a workaround that turns off JNDI message lookups. Inventory the JVM flag / environment variable only as a precondition check on unupgraded hosts.","command":"tr '\\0' '\\n' < /proc/<java-pid>/environ | grep -E 'LOG4J_FORMAT_MSG_NO_LOOKUPS|log4j2.formatMsgNoLookups'","affectedMeans":"A vulnerable log4j-core is loaded and the no-lookups flag is absent. Lookups still expand attacker strings.","fixedMeans":"log4j-core is on the hardened line, or (interim only) LOG4J_FORMAT_MSG_NO_LOOKUPS=true / log4j2.formatMsgNoLookups=true is set for every Java process still on 2.10-2.14. Apache 14 Dec 2021: that flag does not mitigate CVE-2021-45046. Apache's current 44228 page lists upgrade only.","sources":[{"url":"https://www.microsoft.com/en-us/security/blog/2021/12/11/guidance-for-preventing-detecting-and-hunting-for-cve-2021-44228-log4j-2-exploitation/","date":"2021-12-11","publisher":"Microsoft"},{"url":"https://logging.apache.org/security.html","date":"2021-12-10","publisher":"Apache Logging Services"},{"url":"https://lists.apache.org/thread/83y7dx5xvn3h5290q1twn16tltolv88f","date":"2021-12-14","publisher":"Apache Logging Services"}]},{"id":"v2s-aia-log4shell-exposure-4","kind":"exposure","title":"Inventory your own internet-facing apps that can log attacker strings","detail":"There is no single Log4j banner. Scope product searches to your ranges and then run the JAR inventory on those hosts. Do not send jndi lookup probes. VMware Horizon is one vendor-stated affected product (VMSA-2021-0028) and is used here only as an example title scoped to your range.","command":"shodan search 'http.title:\"VMware Horizon\" net:<your-range>'","affectedMeans":"A host in your range matches a product known to have shipped log4j-core. Confirm the JAR version on that host. Do not treat a product title alone as proof of CVE-2021-44228.","fixedMeans":"No matching hosts, or each matching host's log4j-core copies are on the hardened line (2.17.1+ / 2.12.4 / 2.3.2) or the vendor states that product build is fixed.","notes":"Many affected products have no useful banner. Prefer SBOM and JAR find over internet search.","sources":[{"url":"https://www.vmware.com/security/advisories/VMSA-2021-0028.html","date":"2021-12-10","publisher":"VMware"},{"url":"https://www.cisa.gov/news-events/news/apache-log4j-vulnerability-guidance","date":"2021-12-17","publisher":"CISA"}]}],"limits":["find can miss nested JARs inside Uber-JARs and vendor appliances.","Apache's current CVE-2021-44228 row lists 2.15.0 as the first Java 8 fix; follow-on CVEs require the later hardened line.","Do not send ${jndi:ldap://...} or obfuscated lookup strings to applications."],"sources":[{"url":"https://logging.apache.org/security.html","date":"2021-12-10","publisher":"Apache Logging Services"},{"url":"https://www.microsoft.com/en-us/security/blog/2021/12/11/guidance-for-preventing-detecting-and-hunting-for-cve-2021-44228-log4j-2-exploitation/","date":"2021-12-11","publisher":"Microsoft"},{"url":"https://www.cisa.gov/news-events/news/apache-log4j-vulnerability-guidance","date":"2021-12-17","publisher":"CISA"},{"url":"https://lists.apache.org/thread/83y7dx5xvn3h5290q1twn16tltolv88f","date":"2021-12-14","publisher":"Apache Logging Services"},{"url":"https://www.vmware.com/security/advisories/VMSA-2021-0028.html","date":"2021-12-10","publisher":"VMware"}],"updatedAt":"2026-10-24","addedDate":"2026-10-24"},"mitigations":{"summary":"Microsoft documented turning off message lookups and restricting outbound JNDI-style callbacks while you upgrade. Apache's current CVE-2021-44228 page lists upgrade as the mitigation. Prefer removing or replacing log4j-core.","items":[{"title":"Set LOG4J_FORMAT_MSG_NO_LOOKUPS / log4j2.formatMsgNoLookups=true","detail":"Microsoft documented turning off JNDI message lookups with the LOG4J_FORMAT_MSG_NO_LOOKUPS environment variable as a workaround while patching. Apply to every Java process that still loads a vulnerable log4j-core.","limits":"Interim only. Apache's current CVE-2021-44228 page lists upgrade as the mitigation. Apache 14 Dec 2021 CVE-2021-45046 announcement: previous mitigations that set the system property log4j2.noFormatMsgLookup to true do not mitigate CVE-2021-45046. That covers formatMsgNoLookups / LOG4J_FORMAT_MSG_NO_LOOKUPS. Prefer removing or upgrading log4j-core over leaving this flag in place.","verify":"tr '\\0' '\\n' < /proc/<java-pid>/environ | grep LOG4J_FORMAT_MSG_NO_LOOKUPS  (expect true). Also confirm no unpatched log4j-core remains if you are treating the host as fixed.","source":{"url":"https://www.microsoft.com/en-us/security/blog/2021/12/11/guidance-for-preventing-detecting-and-hunting-for-cve-2021-44228-log4j-2-exploitation/","date":"2021-12-11","publisher":"Microsoft"}},{"title":"Restrict egress from application hosts to unexpected LDAP, RMI, and DNS callbacks","detail":"Successful exploitation often causes the JVM to contact an attacker-controlled naming service. Microsoft hunting focuses on outbound LDAP/RMI/DNS from java. Restrict that egress while patching rolls out.","limits":"Interim only. Does not stop local class loading if an attacker can already reach a naming service inside the network. Does not replace upgrading log4j-core.","verify":"Review firewall / host egress policy for java to ports 389, 636, 1389, 1099, and newly observed DNS from app tiers. Confirm no unexpected public LDAP/RMI from those hosts.","source":{"url":"https://www.microsoft.com/en-us/security/blog/2021/12/11/guidance-for-preventing-detecting-and-hunting-for-cve-2021-44228-log4j-2-exploitation/","date":"2021-12-11","publisher":"Microsoft"}}],"updatedAt":"2026-10-24","addedDate":"2026-10-24"},"response":{"summary":"A logged JNDI lookup plus an outbound LDAP, RMI, or DNS callback means the lookup ran. Microsoft observed coin miners, Cobalt Strike, reverse shells, and ransomware after successful exploitation.","containment":[{"title":"Isolate hosts that show a JNDI string followed by an outbound LDAP/RMI/DNS callback","detail":"Microsoft: a logged lookup plus a callback means the lookup ran. Isolate those application hosts, collect memory and disk, and review lateral movement.","sources":[{"url":"https://www.microsoft.com/en-us/security/blog/2021/12/11/guidance-for-preventing-detecting-and-hunting-for-cve-2021-44228-log4j-2-exploitation/","date":"2021-12-11","publisher":"Microsoft"}]},{"title":"Upgrade every log4j-core copy to the hardened line","detail":"Apache first fixes for CVE-2021-44228 are 2.3.1 / 2.12.2 / 2.15.0. Because CVE-2021-45046, CVE-2021-45105, and CVE-2021-44832 followed, prefer 2.17.1 (Java 8+), 2.12.4 (Java 7), or 2.3.2 (Java 6).","sources":[{"url":"https://logging.apache.org/security.html","date":"2021-12-10","publisher":"Apache Logging Services"}]},{"title":"Hunt java child processes and common post-exploitation kits","detail":"Microsoft observed coin miners, Cobalt Strike, reverse shells, Meterpreter, Bladabindi, HabitsRAT, Tsunami, Webtoos, and ransomware including Khonsari (Minecraft) and NightSky (VMware Horizon from 4 Jan 2022). Review java spawning sh, bash, curl, wget, cmd, or powershell.","sources":[{"url":"https://www.microsoft.com/en-us/security/blog/2021/12/11/guidance-for-preventing-detecting-and-hunting-for-cve-2021-44228-log4j-2-exploitation/","date":"2021-12-11","publisher":"Microsoft"}]}],"rotate":[{"item":"Credentials and keys readable by the Java process on hosts with a confirmed callback or java child shell","reason":"RCE runs as the logging process. Microsoft also observed Mimikatz after PowerShell reverse shells on Minecraft clients, and data leakage via the lookup without a dropped payload (including from SSL-terminating devices).","generic":true,"sources":[{"url":"https://www.microsoft.com/en-us/security/blog/2021/12/11/guidance-for-preventing-detecting-and-hunting-for-cve-2021-44228-log4j-2-exploitation/","date":"2021-12-11","publisher":"Microsoft"}]}],"persistence":[{"kind":"other","value":"Coin miners, Cobalt Strike, and reverse shells after successful Log4Shell","detail":"Microsoft 11 Dec 2021 (updated into 2022): observed installing coin miners, using Cobalt Strike for credential theft and lateral movement, and establishing remote shells. No single shared filesystem path.","sourceUrl":"https://www.microsoft.com/en-us/security/blog/2021/12/11/guidance-for-preventing-detecting-and-hunting-for-cve-2021-44228-log4j-2-exploitation/","sourceDate":"2021-12-11"},{"kind":"other","value":"Khonsari ransomware via vulnerable Minecraft Java Edition","detail":"Microsoft: Khonsari launched from compromised Minecraft clients connected to modified servers running vulnerable Log4j 2, executed as javaw.exe.","sourceUrl":"https://www.microsoft.com/en-us/security/blog/2021/12/11/guidance-for-preventing-detecting-and-hunting-for-cve-2021-44228-log4j-2-exploitation/","sourceDate":"2021-12-11"},{"kind":"other","value":"NightSky ransomware after VMware Horizon exploitation","detail":"Microsoft January 2022 recap: from 4 Jan 2022, CVE-2021-44228 on internet-facing VMware Horizon led to NightSky (DEV-0401). CnC domains are listed in that update.","sourceUrl":"https://www.microsoft.com/en-us/security/blog/2021/12/11/guidance-for-preventing-detecting-and-hunting-for-cve-2021-44228-log4j-2-exploitation/","sourceDate":"2022-01-10"},{"kind":"other","value":"Tsunami backdoor, Webtoos, and botnet uptake (including Mirai)","detail":"Microsoft: existing botnets and campaigns added the exploit; Tsunami backdoor on Linux; Webtoos deployed via the vulnerability (RiskIQ/Microsoft).","sourceUrl":"https://www.microsoft.com/en-us/security/blog/2021/12/11/guidance-for-preventing-detecting-and-hunting-for-cve-2021-44228-log4j-2-exploitation/","sourceDate":"2021-12-11"}],"evidence":[{"title":"Web, proxy, and application logs containing JNDI lookup strings","detail":"Microsoft: strings containing jndi followed by ldap, ldaps, rmi, dns, iiop, or http, including obfuscated ${lower:} / ${::-j} forms in URLs, User-Agent, Referer, and other headers. Search from 1 Dec 2021 (Cloudflare earliest scanning).","sources":[{"url":"https://www.microsoft.com/en-us/security/blog/2021/12/11/guidance-for-preventing-detecting-and-hunting-for-cve-2021-44228-log4j-2-exploitation/","date":"2021-12-11","publisher":"Microsoft"},{"url":"https://blog.cloudflare.com/exploitation-of-cve-2021-44228-before-public-disclosure-and-evolution-of-waf-evasion-patterns/","date":"2021-12-14","publisher":"Cloudflare"}]},{"title":"Outbound LDAP / RMI / DNS from java","detail":"Microsoft: JVM contacting attacker-controlled naming services. Preserve NetFlow, DNS resolver logs, and EDR network events for java.exe / javaw / java to ports 389, 636, 1389, 1099.","sources":[{"url":"https://www.microsoft.com/en-us/security/blog/2021/12/11/guidance-for-preventing-detecting-and-hunting-for-cve-2021-44228-log4j-2-exploitation/","date":"2021-12-11","publisher":"Microsoft"}]},{"title":"Java child-process telemetry and disk copies of log4j-core","detail":"Preserve process creation for java spawning shells or downloaders, plus the JAR paths found during inventory. Raw 2021 web logs are often gone; persistent artefacts and backups matter more now.","generic":true,"sources":[{"url":"https://www.microsoft.com/en-us/security/blog/2021/12/11/guidance-for-preventing-detecting-and-hunting-for-cve-2021-44228-log4j-2-exploitation/","date":"2021-12-11","publisher":"Microsoft"}]}],"sources":[{"url":"https://www.microsoft.com/en-us/security/blog/2021/12/11/guidance-for-preventing-detecting-and-hunting-for-cve-2021-44228-log4j-2-exploitation/","date":"2021-12-11","publisher":"Microsoft"},{"url":"https://logging.apache.org/security.html","date":"2021-12-10","publisher":"Apache Logging Services"},{"url":"https://www.microsoft.com/en-us/security/blog/2021/12/11/guidance-for-preventing-detecting-and-hunting-for-cve-2021-44228-log4j-2-exploitation/","date":"2022-01-10"},{"url":"https://blog.cloudflare.com/exploitation-of-cve-2021-44228-before-public-disclosure-and-evolution-of-waf-evasion-patterns/","date":"2021-12-14","publisher":"Cloudflare"}],"updatedAt":"2026-10-24","addedDate":"2026-10-24"},"bulletins":[{"vendor":"Akamai","title":"CVE-2021-44228: Zero-day Vulnerability in Apache Log4j","url":"https://www.akamai.com/blog/news/cve-2021-44228-zero-day-vulnerability","date":"2021-12-11","cve":"CVE-2021-44228"},{"vendor":"AWS","title":"AWS Managed Rules changelog: Known bad inputs, Log4JRCE","url":"https://docs.aws.amazon.com/waf/latest/developerguide/aws-managed-rule-groups-changelog.html","date":"2021-12-10","cve":"CVE-2021-44228"},{"vendor":"Azure","title":"Application Gateway WAF DRS and CRS rule groups and rules","url":"https://learn.microsoft.com/en-us/azure/web-application-firewall/ag/application-gateway-crs-rulegroups-rules","date":"2026-10-23","cve":"CVE-2021-44228"},{"vendor":"Barracuda","title":"Barracuda attack definition release notes, 1.208 to 1.211","url":"https://updates.cudasvc.com/cgi-bin/view_release_notes.cgi?type=attackdef&version=1.224","date":"2021-12-13","cve":"CVE-2021-44228"},{"vendor":"Cato Networks","title":"Cato Networks rapid response to the Apache Log4j RCE vulnerability","url":"https://www.catonetworks.com/blog/cato-networks-rapid-response-to-the-apache-log4j-remote-code-execution-vulnerability/","date":"2021-12-11","cve":"CVE-2021-44228"},{"vendor":"Cato Networks","title":"Rapid CVE Mitigation by Cato Security Research","url":"https://www.catonetworks.com/rapid-cve-mitigation/","date":"2026-10-23","cve":"CVE-2021-44228","dateKind":"checked"},{"vendor":"Check Point","title":"CPAI-2021-0936 Apache Log4j Remote Code Execution (CVE-2021-44228)","url":"https://advisories.checkpoint.com/defense/advisories/public/2021/cpai-2021-0936.html","date":"2021-12-10","cve":"CVE-2021-44228"},{"vendor":"Cisco Talos","title":"Snort Talos Rules 2021-12-10","url":"https://www.snort.org/advisories/talos-rules-2021-12-10","date":"2021-12-10","cve":"CVE-2021-44228"},{"vendor":"Citrix","title":"NetScaler signature update version 72","url":"https://docs.netscaler.com/en-us/citrix-adc/13-1/signature-alerts/signature-update-version-72.html","date":"2026-10-23","cve":"CVE-2021-44228","dateKind":"checked"},{"vendor":"Citrix","title":"NetScaler signature update version 73","url":"https://docs.netscaler.com/en-us/citrix-adc/13-1/signature-alerts/signature-update-version-73.html","date":"2026-10-23","cve":"CVE-2021-44228, CVE-2021-45046","dateKind":"checked"},{"vendor":"Cloudflare","title":"Protection against CVE-2021-45046, the additional Log4j RCE vulnerability","url":"https://blog.cloudflare.com/protection-against-cve-2021-45046-the-additional-log4j-rce-vulnerability/","date":"2021-12-14","cve":"CVE-2021-44228"},{"vendor":"F5","title":"Protection against the Apache Log4j2 vulnerability (CVE-2021-44228)","url":"https://www.f5.com/company/blog/protection-against-apache-log4j2-vulnerability","date":"2021-12-14","cve":"CVE-2021-44228"},{"vendor":"F5","title":"F5 Distributed Cloud attack signatures reference","url":"https://docs.cloud.f5.com/docs-v2/platform/reference/attack-signatures","date":"2021-12-22","cve":"CVE-2021-44228"},{"vendor":"Fastly","title":"Added virtual patch for CVE-2021-44228","url":"https://www.fastly.com/documentation/reference/changes/2021/12/added-virtual-patch-for-cve-2021-44228/","date":"2021-12-10","cve":"CVE-2021-44228"},{"vendor":"Fortinet","title":"FortiGuard Outbreak Alert: Apache Log4j2 vulnerability","url":"https://www.fortiguard.com/outbreak-alert/log4j2-vulnerability","date":"2026-10-23","cve":"CVE-2021-44228","dateKind":"checked"},{"vendor":"Google Cloud","title":"Cloud Armor WAF rule to help address Apache Log4j vulnerability","url":"https://cloud.google.com/blog/products/identity-security/cloud-armor-waf-rule-to-help-address-apache-log4j-vulnerability","date":"2021-12-12","cve":"CVE-2021-44228"},{"vendor":"Imperva","title":"How we're protecting customers and staying ahead of CVE-2021-44228","url":"https://www.imperva.com/blog/how-were-protecting-customers-staying-ahead-of-cve-2021-44228/","date":"2021-12-11","cve":"CVE-2021-44228"},{"vendor":"Juniper","title":"HTTP:APACHE:LOG4J-JNDI-MGNR-RCE","url":"https://www.juniper.net/us/en/threatlabs/ips-signatures/detail.HTTP:APACHE:LOG4J-JNDI-MGNR-RCE.html","date":"2021-12-11","cve":"CVE-2021-44228"},{"vendor":"Netskope","title":"Netskope Threat Coverage: Apache Log4j RCE (CVE-2021-44228)","url":"https://threatlabs.netskope.com/blog/2021/12/netskope-threat-coverage-apache-log4j-rce-cve-2021-44228/","date":"2021-12-13","cve":"CVE-2021-44228"},{"vendor":"Netskope","title":"SERVER-WEBAPP Apache Log4j logging remote code execution attempt (library entry, undated)","url":"https://threatlabs.netskope.com/library/ips/server-webapp-apache-log4j-logging-remote-code-execution-attempt/","date":"2026-10-23","cve":"CVE-2021-44228","dateKind":"checked"},{"vendor":"OWASP CRS","title":"CRS and Log4j / Log4Shell / CVE-2021-44228","url":"https://coreruleset.org/20211213/crs-and-log4j-log4shell-cve-2021-44228/","date":"2021-12-13","cve":"CVE-2021-44228"},{"vendor":"OWASP CRS","title":"coreruleset PR #2349: new rules 932131, 944140, 944141","url":"https://github.com/coreruleset/coreruleset/pull/2349","date":"2022-02-07","cve":"CVE-2021-44228"},{"vendor":"Palo Alto Networks","title":"Apache log4j Vulnerability CVE-2021-44228: Analysis and Mitigations","url":"https://unit42.paloaltonetworks.com/apache-log4j-vulnerability-cve-2021-44228/","date":"2021-12-10","cve":"CVE-2021-44228"},{"vendor":"Sophos","title":"Sophos IPS signature update 18.24.96","url":"https://docs.sophos.com/releasenotes/output/en-us/nsg/IPSReleaseNotes/18.24.96.html","date":"2026-06-03","cve":"CVE-2021-44228"},{"vendor":"Trend Micro","title":"Deep Security coverage of Log4j vulnerability","url":"https://help.deepsecurity.trendmicro.com/20_0/on-premise/log4j-coverage.html","date":"2021-12-09","cve":"CVE-2021-44228"},{"vendor":"Trend Micro","title":"SB#1091: Security Advisory for CVE-2021-44228 (Apache Log4j)","url":"https://success.trendmicro.com/en-US/solution/KA-0012652","date":"2021-12-16","cve":"CVE-2021-44228","dateKind":"checked"},{"vendor":"Zscaler","title":"Security advisory: Log4j 0-day remote code execution vulnerability (CVE-2021-44228)","url":"https://www.zscaler.com/blogs/security-research/security-advisory-log4j-0-day-remote-code-execution-vulnerability-cve-2021","date":"2021-12-11","cve":"CVE-2021-44228"}],"coverage":[{"title":"Apache Log4j Security Vulnerabilities","publisher":"Apache Logging Services","url":"https://logging.apache.org/security.html","date":"2021-12-10","type":"vendor"},{"title":"Inside the Log4j2 vulnerability (CVE-2021-44228)","publisher":"Cloudflare","url":"https://blog.cloudflare.com/inside-the-log4j2-vulnerability-cve-2021-44228/","date":"2021-12-10","type":"research"},{"title":"Exploitation of CVE-2021-44228 before public disclosure","publisher":"Cloudflare","url":"https://blog.cloudflare.com/exploitation-of-cve-2021-44228-before-public-disclosure-and-evolution-of-waf-evasion-patterns/","date":"2021-12-14","type":"research"},{"title":"Guidance for preventing, detecting, and hunting for CVE-2021-44228","publisher":"Microsoft","url":"https://www.microsoft.com/en-us/security/blog/2021/12/11/guidance-for-preventing-detecting-and-hunting-for-cve-2021-44228-log4j-2-exploitation/","date":"2021-12-11","type":"research"},{"title":"Apache Log4j Vulnerability Guidance","publisher":"CISA","url":"https://www.cisa.gov/news-events/news/apache-log4j-vulnerability-guidance","date":"2021-12-17","type":"government"},{"title":"VMSA-2021-0028","publisher":"VMware","url":"https://www.vmware.com/security/advisories/VMSA-2021-0028.html","date":"2021-12-10","type":"vendor"}],"posts":[],"research":[{"title":"Apache Log4j Security page","url":"https://logging.apache.org/security.html","authors":"Apache Logging Services","date":"2021-12-10"},{"title":"NVD CVE-2021-44228","url":"https://nvd.nist.gov/vuln/detail/CVE-2021-44228","authors":"NVD","date":"2021-12-10"},{"title":"Cloudflare early exploitation analysis","url":"https://blog.cloudflare.com/exploitation-of-cve-2021-44228-before-public-disclosure-and-evolution-of-waf-evasion-patterns/","authors":"Cloudflare","date":"2021-12-14"},{"title":"Microsoft hunting guidance","url":"https://www.microsoft.com/en-us/security/blog/2021/12/11/guidance-for-preventing-detecting-and-hunting-for-cve-2021-44228-log4j-2-exploitation/","authors":"Microsoft","date":"2021-12-11"},{"title":"Cisco product advisory","url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-log4j-qRuKNEbd","authors":"Cisco PSIRT","date":"2021-12-10"},{"title":"GitHub Advisory GHSA-jfh8-c2jp-5v3q","url":"https://github.com/advisories/GHSA-jfh8-c2jp-5v3q","authors":"GitHub","date":"2021-12-10"}],"impact":{"kind":"shared-component","component":"Apache Log4j 2 (log4j-core)","matrixNote":"Apache later published follow-on CVEs (45046, 45105, 44832). Prefer 2.17.1+ / 2.12.4 / 2.3.2 over the first 2.15.0 hotfix alone.","downstream":[{"product":"Apache Log4j 2","vendor":"Apache Software Foundation","type":"cms-app","status":"affected","versions":"2.17.1 / 2.12.4 / 2.3.2","vendorStatement":{"date":"10 Dec 2021","url":"https://logging.apache.org/security.html","quote":"Versions affected [2.0-beta9, 2.3.1) U [2.4, 2.12.2) U [2.13.0, 2.15.0). JNDI lookup can be exploited to execute arbitrary code loaded from an LDAP server."}},{"product":"VMware products (multiple)","vendor":"VMware","type":"cms-app","status":"affected","versions":"See VMSA-2021-0028 response matrix","vendorStatement":{"date":"10 Dec 2021","url":"https://www.vmware.com/security/advisories/VMSA-2021-0028.html","quote":"Critical vulnerabilities in Apache Log4j identified by CVE-2021-44228 and CVE-2021-45046 have been publicly disclosed which impact VMware products."}},{"product":"Cisco products (multiple)","vendor":"Cisco","type":"network-security","status":"affected","versions":"See cisco-sa-apache-log4j-qRuKNEbd","vendorStatement":{"date":"10 Dec 2021","url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-log4j-qRuKNEbd","quote":"First Published: 2021 December 10 18:45 GMT. Critical Vulnerabilities in Apache Log4j Java Logging Library."}},{"product":"FortiOS / FortiGate","vendor":"Fortinet","type":"network-security","notes":"Fortinet lists many other products as impacted or under investigation in FG-IR-21-245.","status":"vendor-stated-not-affected","vendorStatement":{"date":"12 Dec 2021","url":"https://www.fortiguard.com/psirt/FG-IR-21-245","quote":"The following products are NOT impacted: FortiOS (includes FortiGate & FortiWiFi)."}},{"product":"Minecraft: Java Edition","vendor":"Mojang / Microsoft","type":"cms-app","status":"affected","versions":"Patched launcher / 1.18.1; JVM flags for older servers","vendorStatement":{"date":"10 Dec 2021","url":"https://www.minecraft.net/en-us/article/important-message--security-vulnerability-java-edition","quote":"This exploit affects many services including Minecraft Java Edition. Versions below 1.7 are not affected."}},{"product":"Ghidra","vendor":"NSA","type":"cms-app","status":"affected","versions":"Ghidra 10.1 (includes Log4j 2.15.0)","vendorStatement":{"date":"Checked 23 Oct 2026","url":"https://github.com/NationalSecurityAgency/ghidra/releases/tag/Ghidra_10.1_build","quote":"Includes log4j 2.15.0 which addresses the issue."}},{"product":"Red Hat OpenShift Logging (Elasticsearch components)","vendor":"Red Hat","type":"cloud-container-hosting","status":"affected","versions":"RHSA-2021:5127 through RHSA-2021:5137 (14 Dec 2021)","vendorStatement":{"date":"10 Dec 2021","url":"https://access.redhat.com/security/cve/cve-2021-44228","quote":"In Red Hat OpenShift Logging the vulnerable log4j library is shipped in the Elasticsearch components."}}]},"pocs":[{"title":"log4j-shell-poc","url":"https://github.com/kozmer/log4j-shell-poc","source":"kozmer","validationStatus":"validated","validationDate":"2021-12-10","notes":"Public PoC repository created 10 Dec 2021. Description: A Proof-Of-Concept for the CVE-2021-44228 vulnerability."}],"_feed":{"page":"https://vuln2shell.com/vulns/log4shell","json":"https://vuln2shell.com/vulns/log4shell.json","iocsCsv":"https://vuln2shell.com/vulns/log4shell/iocs.csv","stix":"https://vuln2shell.com/vulns/log4shell/stix.json"}}