Log4Shell exploitation observed hitting Japan
IPA warns that attacks exploiting the Apache Log4j remote code execution vulnerability (Log4Shell) have been observed in Japan and urges immediate patching.
Sourceipa.go.jp — open the original
What to check
- Applies to
- The 1 CVE named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
Japan's IPA (Information-technology Promotion Agency) issued an alert on the Apache Log4j vulnerability commonly known as Log4Shell, warning that exploitation attempts believed to abuse this flaw have been observed domestically. The advisory notes the vulnerability allows a remote attacker to execute arbitrary commands by sending specially crafted data to systems using vulnerable versions of the Log4j Java logging library, affecting Log4j 2.x versions prior to 2.15.0 (with some exceptions in the 2.12 branch).
The advisory clarifies that Log4j 1.x, though end-of-life, is not affected under default configuration since it lacks the JNDI lookup feature, though certain specific configurations could still expose risk. IPA recommends organizations update immediately to patched versions (2.17.0 or 2.12.3, which also address a related denial-of-service issue tracked as CVE-2021-45105) and apply interim mitigations if immediate patching is not possible, including restricting outbound network connections to reduce the impact of exploitation attempts. The bulletin was updated multiple times between December 13-27, 2021 as vendor guidance and mitigation details evolved.
Mentioned in this report
Detection guidance
Log4j JNDI Lookup Exploitation Attempt via Network
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects outbound DNS or LDAP queries from Java processes containing JNDI lookup patterns (jndi:ldap, jndi:rmi) indicative of Log4Shell exploitation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Log4j JNDI Lookup Exploitation Attempt via Network
description: 'Detects Java processes initiating outbound DNS queries or LDAP/RMI connections
with JNDI lookup schemes typical of Log4Shell exploitation. Matches the distinctive
jndi: protocol prefix in DNS queries or network connections, independent of specific
attacker infrastructure.'
tags:
- attack.t1190
logsource:
category: dns_query
product: windows
detection:
selection_dns:
QueryName|contains:
- jndi:ldap://
- jndi:rmi://
- jndi:nis://
- jndi:iiop://
Image|endswith:
- \\java.exe
- \\javaw.exe
condition: selection_dns
falsepositives:
- Legitimate Java applications performing JNDI lookups in enterprise environments
- Development/testing environments with intentional JNDI configuration
level: high
id: 0096b038-a737-595e-8dd8-02aed8fadcc8
status: experimental
author: Vorant
Suspicious Java Process Execution with Log4j Environment Indicators
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects Java processes spawned with command-line arguments containing Log4j configuration overrides or disable flags (log4j.formatMsgNoLookups=true, log4j2.formatMsgNoLookups=true) applied post-exploitation or during emergency response, indicating system has been targeted. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Suspicious Java Process Execution with Log4j Mitigation Flags
description: Detects Java processes launched with Log4j JNDI lookup disable flags
in command line, indicating either active exploitation attempts with defensive flags
or rapid patching response. The presence of formatMsgNoLookups flags during normal
operations is rare and suggests known vulnerability context.
tags:
- attack.t1190
logsource:
category: process_creation
product: windows
detection:
selection:
Image|endswith:
- \\java.exe
- \\javaw.exe
CommandLine|contains:
- log4j.formatMsgNoLookups=true
- log4j2.formatMsgNoLookups=true
- -Dlog4j2.formatMsgNoLookups=true
filter_deployment:
CommandLine|contains:
- ansible
- puppet
- chef
- salt
condition: selection and not filter_deployment
falsepositives:
- Automated remediation scripts deployed organization-wide in response to Log4Shell
awareness
- Configuration management systems applying Log4j patches and mitigations
level: low
id: 26d5632d-d3d1-587e-be56-886aff83c14f
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.ipa.go.jp/archive/security/security-alert/2021/alert20211213.html
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,436 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs