Log4Shell exploitation observed hitting Japan
IPA warns that attacks exploiting the Apache Log4j remote code execution vulnerability (Log4Shell) have been observed in Japan and urges immediate patching.
Japan's IPA (Information-technology Promotion Agency) issued an alert on the Apache Log4j vulnerability commonly known as Log4Shell, warning that exploitation attempts believed to abuse this flaw have been observed domestically. The advisory notes the vulnerability allows a remote attacker to execute arbitrary commands by sending specially crafted data to systems using vulnerable versions of the Log4j Java logging library, affecting Log4j 2.x versions prior to 2.15.0 (with some exceptions in the 2.12 branch).
The advisory clarifies that Log4j 1.x, though end-of-life, is not affected under default configuration since it lacks the JNDI lookup feature, though certain specific configurations could still expose risk. IPA recommends organizations update immediately to patched versions (2.17.0 or 2.12.3, which also address a related denial-of-service issue tracked as CVE-2021-45105) and apply interim mitigations if immediate patching is not possible, including restricting outbound network connections to reduce the impact of exploitation attempts. The bulletin was updated multiple times between December 13-27, 2021 as vendor guidance and mitigation details evolved.
Mentioned in this report
Detection guidance
Log4j JNDI Lookup Exploitation Attempt via Network
Detects outbound DNS or LDAP queries from Java processes containing JNDI lookup patterns (jndi:ldap, jndi:rmi) indicative of Log4Shell exploitation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Log4j JNDI Lookup Exploitation Attempt via Network
description: 'Detects Java processes initiating outbound DNS queries or LDAP/RMI connections
with JNDI lookup schemes typical of Log4Shell exploitation. Matches the distinctive
jndi: protocol prefix in DNS queries or network connections, independent of specific
attacker infrastructure.'
tags:
- attack.t1190
logsource:
category: dns_query
product: windows
detection:
selection_dns:
QueryName|contains:
- jndi:ldap://
- jndi:rmi://
- jndi:nis://
- jndi:iiop://
Image|endswith:
- \\java.exe
- \\javaw.exe
condition: selection_dns
falsepositives:
- Legitimate Java applications performing JNDI lookups in enterprise environments
- Development/testing environments with intentional JNDI configuration
level: high
id: 0096b038-a737-595e-8dd8-02aed8fadcc8
status: experimental
author: Vorant
Java Process Loading Remote Class via Log4j Exploitation
Detects Java processes initiating unexpected outbound connections to remote hosts on ports commonly used for LDAP/RMI (389, 636, 1099) in a pattern consistent with Log4Shell JNDI lookup exploitation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Java Process Loading Remote Class via Log4j Exploitation
description: Detects Java processes making outbound connections to LDAP/RMI ports
(389, 636, 1099) immediately following HTTP request processing, consistent with
Log4Shell exploitation via JNDI lookups. Focuses on parent process and destination
port pattern rather than specific attacker IPs.
tags:
- attack.t1190
logsource:
category: network_connection
product: windows
detection:
selection:
Image|endswith:
- \\java.exe
- \\javaw.exe
DestinationPort:
- 389
- 636
- 1099
InitiatingProcessName|endswith:
- java.exe
- javaw.exe
filter_internal:
DestinationIp|cidr:
- 10.0.0.0/8
- 172.16.0.0/12
- 192.168.0.0/16
- 127.0.0.0/8
condition: selection and not filter_internal
falsepositives:
- Java application servers configured to use internal LDAP for authentication
- Enterprise directory services integration with Java middleware
level: medium
id: 87bcca05-4904-5dbc-bfae-e900c68babd2
status: experimental
author: Vorant
Suspicious Java Process Execution with Log4j Environment Indicators
Detects Java processes spawned with command-line arguments containing Log4j configuration overrides or disable flags (log4j.formatMsgNoLookups=true, log4j2.formatMsgNoLookups=true) applied post-exploitation or during emergency response, indicating system has been targeted. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Suspicious Java Process Execution with Log4j Mitigation Flags
description: Detects Java processes launched with Log4j JNDI lookup disable flags
in command line, indicating either active exploitation attempts with defensive flags
or rapid patching response. The presence of formatMsgNoLookups flags during normal
operations is rare and suggests known vulnerability context.
tags:
- attack.t1190
logsource:
category: process_creation
product: windows
detection:
selection:
Image|endswith:
- \\java.exe
- \\javaw.exe
CommandLine|contains:
- log4j.formatMsgNoLookups=true
- log4j2.formatMsgNoLookups=true
- -Dlog4j2.formatMsgNoLookups=true
filter_deployment:
CommandLine|contains:
- ansible
- puppet
- chef
- salt
condition: selection and not filter_deployment
falsepositives:
- Automated remediation scripts deployed organization-wide in response to Log4Shell
awareness
- Configuration management systems applying Log4j patches and mitigations
level: low
id: 26d5632d-d3d1-587e-be56-886aff83c14f
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.ipa.go.jp/archive/security/security-alert/2021/alert20211213.html
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free