# Log4Shell exploitation observed in Japan

Published: 2021-12-13 · Severity: critical
Canonical: https://vorant.io/reports/1b470680-c13e-510c-94c6-02d7cc5e867a/log4shell-exploitation-observed-in-japan

> IPA warns that active exploitation of the critical Apache Log4j remote code execution vulnerability (Log4Shell) has been observed in Japan, urging immediate patching.

The Information-technology Promotion Agency, Japan (IPA) issued an alert regarding a critical remote code execution vulnerability in Apache Log4j, a widely used Java-based logging library maintained by the Apache Software Foundation. The flaw allows a remote attacker to execute arbitrary commands by sending specially crafted data to a vulnerable system. IPA reports that attacks believed to exploit this vulnerability have been observed within Japan, and warns that damage could expand, urging organizations to apply mitigations immediately.

The advisory covers Log4j 2.x versions prior to 2.15.0 (excluding 2.12.2 and later within the 2.12.x branch), including the 2.15.0-rc1 release candidate. The legacy Log4j 1.x branch, which has reached end-of-life, is generally not affected since it lacks the Lookup feature and does not deserialize class information even when JMS Appender is enabled, though certain configurations may still be vulnerable. IPA recommends updating to patched versions (2.17.0, 2.12.3, and others addressing related issues including CVE-2021-45105) and notes that earlier workarounds were found insufficient against certain attack variants. Additional mitigations include restricting outbound network connections and tightening access controls to reduce the impact of exploitation attempts.

This alert reflects the widely known Log4Shell vulnerability disclosure and exploitation wave from December 2021, which affected a vast range of software products relying on Log4j. IPA's advisory was updated multiple times as new information, vendor patches, and mitigation guidance became available, reflecting the evolving and urgent nature of the threat during this period.

## Mentioned in this report

- Vulnerabilities: CVE-2021-44228 (KEV), CVE-2021-45105

## Detection guidance (public sample)

### Possible Log4Shell JNDI Exploitation String in HTTP Request

ATT&CK: T1190

Detects JNDI LDAP/RMI/DNS lookup patterns (e.g. ${jndi:ldap://) commonly used in Log4Shell exploitation attempts within HTTP request fields such as URI, headers, or User-Agent. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Possible Log4Shell JNDI Exploitation String in HTTP Request
logsource:
  category: proxy
  product: windows
detection:
  selection:
    c-uri|contains:
    - '${jndi:ldap:'
    - '${jndi:rmi:'
    - '${jndi:dns:'
    - '${jndi:ldaps:'
    - '${jndi:iiop:'
    - '${jndi:corba:'
    - '${jndi:nis:'
    - '${jndi:nds:'
  selection_headers:
    cs-user-agent|contains:
    - '${jndi:'
    cs-cookie|contains:
    - '${jndi:'
    cs-referrer|contains:
    - '${jndi:'
  condition: selection or selection_headers
falsepositives:
- Vulnerability scanning or penetration testing tools intentionally probing for Log4Shell
- Security research honeypots or automated Log4j vulnerability scanners
level: high
tags:
- attack.t1190
id: def4a49e-1234-549d-b0dd-cd4deb75d124
status: experimental
author: Vorant
```

### Java Process Spawning Command Shell (Possible Log4Shell RCE)

ATT&CK: T1190

Detects a Java process spawning a command interpreter or scripting engine, consistent with successful exploitation of Log4Shell leading to remote code execution. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Java Process Spawning Command Shell (Possible Log4Shell RCE)
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
    - \java.exe
    - \javaw.exe
  selection_child:
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \sh
    - \bash
    - \wget
    - \curl.exe
    - \certutil.exe
  condition: selection_parent and selection_child
falsepositives:
- Legitimate Java applications that intentionally invoke shell commands or scripts
  as part of normal operation
- Build or deployment tools running under a JVM that shell out to system utilities
level: high
tags:
- attack.t1190
- attack.t1059
id: bb6cdf8f-fe94-542d-806a-6293aa698bc6
status: experimental
author: Vorant
```

### Java Process Initiating Outbound LDAP or RMI Connection

ATT&CK: T1190

Detects a Java process establishing an outbound network connection to common LDAP or RMI ports, which may indicate a Log4Shell callback to an attacker-controlled server following JNDI lookup exploitation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Java Process Initiating Outbound LDAP or RMI Connection
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    Image|endswith:
    - \java.exe
    - \javaw.exe
    DestinationPort:
    - 389
    - 636
    - 1099
    - 1389
  filter:
    DestinationIp|startswith:
    - '10.'
    - 192.168.
    - 172.16.
  condition: selection and not filter
falsepositives:
- Legitimate internal LDAP directory service lookups performed by Java applications
- Java RMI-based internal application communication to known internal servers
level: medium
tags:
- attack.t1190
id: a5a07d44-7926-582f-8dfa-93788a67a2af
status: experimental
author: Vorant
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.ipa.go.jp/archive/security/security-alert/2021/alert20211213.html

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/1b470680-c13e-510c-94c6-02d7cc5e867a/log4shell-exploitation-observed-in-japan.
Full IOC sets, deployable detections, the entity graph, TAXII 2.1 feed and real-time alerts: https://vorant.io/signup