Skip to main content

 

Splunk Lantern

Detecting Log4j remote code execution

 

A serious vulnerability (CVE-2021-44228) in the popular open source Apache Log4j logging library poses a threat to thousands of applications and third-party services that leverage this library, allowing attackers to execute arbitrary code from an external source.

You are a security analyst who needs to respond to this. As well as applying an emergency patch for the vulnerability or applying the appropriate mitigations if upgrading is not possible, you also need to look for the presence of Log4j executing remote code in your systems.

Required data

How to use Splunk software for this use case

You can use the following search to identify where Log4j exists in your systems:

You can use the following search to detect the presence of Log4j:

Next steps

If you determine that you have exposure to Log4j in your environment or Github projects, review the guidance from The Apache Software Foundation on patching for the vulnerability. You should also upgrade to Log4j 2.15.0 as soon as possible or apply the appropriate mitigations if upgrading is not possible. If your searching detects that active exploitation of Log4j has occurred, you'll need to follow your organization's processes for assessing the scale of and mitigating for the attack.

The content in this guide comes from a previously published blog, one of the thousands of Splunk resources available to help users succeed. In addition, these Splunk resources might help you understand and implement this use case:

Still need help with this use case? Most customers have OnDemand Services per their license support plan. Engage the ODS team at OnDemand-Inquires@splunk.com if you require assistance.