Java Process Class File Download

Description

Detecting a Java process downloading a class file which could indicate a successful exploit of the log4shell Log4j vulnerability (CVE-2021-44228). This rule is highly specific in its scope.

Query · falco

java_network_read and evt.buffer bcontains cafebabe

Rule dependencies

Depends on

  • composes · Falco macro java_network_read
    A shared condition, not a detection — not indexed on this site.

Analyst notes

Java process class file download | server_ip=%fd.sip server_port=%fd.sport connection=%fd.name lport=%fd.lport rport=%fd.rport fd_type=%fd.type fd_proto=%fd.l4proto evt_type=%evt.type user=%user.name user_uid=%user.uid user_loginuid=%user.loginuid process=%proc.name proc_exepath=%proc.exepath parent=%proc.pname command=%proc.cmdline terminal=%proc.tty

Raw source Java Process Class File Download · Falco YAML
Esc
Published by falcosecurity/rules ↗, licensed under Apache 2.0 ↗. Reproduced here unmodified. 
rule: Java Process Class File Download
desc: 'Detecting a Java process downloading a class file which could indicate a successful
  exploit of the log4shell Log4j vulnerability (CVE-2021-44228). This rule is highly
  specific in its scope.

  '
condition: 'java_network_read and evt.buffer bcontains cafebabe

  '
output: Java process class file download | server_ip=%fd.sip server_port=%fd.sport
  connection=%fd.name lport=%fd.lport rport=%fd.rport fd_type=%fd.type fd_proto=%fd.l4proto
  evt_type=%evt.type user=%user.name user_uid=%user.uid user_loginuid=%user.loginuid
  process=%proc.name proc_exepath=%proc.exepath parent=%proc.pname command=%proc.cmdline
  terminal=%proc.tty
priority: CRITICAL
enabled: false
tags:
- maturity_sandbox
- host
- container
- process
- mitre_initial_access
- T1190

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.