EXPL_Log4j_CVE_2021_44228_Dec21_Soft

rule EXPL_Log4j_CVE_2021_44228_Dec21_Soft : FILE {
   meta:
      description = "Detects indicators in server logs that indicate an exploitation attempt of CVE-2021-44228"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://twitter.com/h113sdx/status/1469010902183661568?s=20"
      date = "2021-12-10"
      modified = "2025-03-24"
      score = 50
      id = "87e536a5-cc11-528a-b100-4fa3b2b7bc0c"
   strings:
      $x01 = "${jndi:ldap:/"
      $x02 = "${jndi:rmi:/"
      $x03 = "${jndi:ldaps:/"
      $x04 = "${jndi:dns:/"
      $x05 = "${jndi:iiop:/"
      $x06 = "${jndi:http:/"
      $x07 = "${jndi:nis:/"
      $x08 = "${jndi:nds:/"
      $x09 = "${jndi:corba:/"

      $fp1 = "<html"
      $fp2 = "/nessus}"
   condition:
      1 of ($x*) and not 1 of ($fp*)
}