SID 1:58814

Rule Category

POLICY-OTHER --

Alert Message

POLICY-OTHER Java User-Agent remote class download attempt

Rule Explanation

This rule logs attempts at Java class downloads with the User-Agent set as Java. These have been observed in successful exploits of Log4J for CVE's CVE-2021-44228 & CVE-2021-45046.

What To Look For

This rule logs attempts at Java class downloads with the User-Agent set as Java.

Known Usage

No public information

False Positives

Known false positives, with the described conditions

This could potentially alert on known good legitimate traffic, so we did not turn this on in any policies. Please do not set this to drop traffic unless you do not wish for this behavior to be allowed. Thank you.

Contributors

Cisco Talos Intelligence Group https://blog.talosintelligence.com/2021/12/apache-log4j-rce-vulnerability.html https://twitter.com/mvelazco/status/1471527094609981443?s=21

Rule Groups

No rule groups

CVE

CVE-2021-44228 CVE-2021-45046 CVE-2021-45105

Rule Vulnerability

N/A

Not Applicable

CVE Additional Information

This product uses data from the NVD API but is not endorsed or certified by the NVD.

CVE-2021-44228

Loading description

CVE-2021-45046

Loading description

CVE-2021-45105

Loading description

MITRE ATT&CK Framework

Tactic: Initial Access

Technique: Exploit Public-Facing Application

For reference, see the MITRE ATT&CK vulnerability types here: https://attack.mitre.org