SUSP_JDNIExploit_Error_Indicators_Dec21_1

rule SUSP_JDNIExploit_Error_Indicators_Dec21_1 {
   meta:
      description = "Detects error messages related to JDNI usage in log files that can indicate a Log4Shell / Log4j exploitation"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://twitter.com/marcioalm/status/1470361495405875200?s=20"
      date = "2021-12-10"
      modified = "2023-06-23"
      score = 70
      id = "68bcf043-58b4-54a9-b024-64871b5d535f"
   strings:
      $x1 = "FATAL log4j - Message: BadAttributeValueException: "
   condition:
      1 of them
}