Apache Log4j remote code execution actively exploited
Apache Log4j remote code execution vulnerability (Log4jShell/CVE-2021-44228) actively exploited; IPA Japan urges immediate patching to version 2.17.0 or 2.12.3.
Sourceipa.go.jp — open the original
What to check
- Applies to
- The 2 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- CISA lists CVE-2021-44228 as exploited in the wild.
Japan's Information-technology Promotion Agency (IPA) issued an advisory on a critical remote code execution vulnerability in Apache Log4j, a widely-used Java logging library. The vulnerability allows remote attackers to execute arbitrary commands by sending specially crafted data to vulnerable systems. IPA reports that exploitation attempts have been observed domestically within Japan, with attacks detected against systems using affected versions.
Affected versions include Apache Log4j 2.x prior to 2.15.0 (excluding 2.12.2 and later in the 2.12 branch). While Log4j 1.x was initially believed unaffected due to lack of Lookup functionality, IPA notes certain configurations may still be vulnerable. The agency emphasizes that earlier mitigations proved insufficient against specific attack vectors.
IPA strongly recommends immediate updates to version 2.17.0 (or 2.12.3 for the 2.12 branch), which address both the original vulnerability and related issue CVE-2021-45105. Organizations unable to patch immediately should implement workarounds and review egress access controls to limit potential impact. Product vendors using Log4j are expected to release their own advisories.
Mentioned in this report
Detection guidance
Suspicious Child Process Spawned from Java Process (Log4Shell Exploitation)
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects a Java process spawning a command interpreter or shell, consistent with post-exploitation of Log4j RCE (Log4Shell) on a vulnerable application server Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Suspicious Child Process Spawned from Java Process
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage|endswith:
- \java.exe
- \javaw.exe
- \javaw.exe
Image|endswith:
- \cmd.exe
- \powershell.exe
- \pwsh.exe
- \bash.exe
- \wscript.exe
- \cscript.exe
- \sh.exe
- \mshta.exe
- \rundll32.exe
- \regsvr32.exe
filter:
CommandLine|contains:
- GetJavaVersion
- JavaUpdate
condition: selection and not filter
falsepositives:
- Legitimate Java applications that intentionally shell out to system utilities (e.g.,
build tools, monitoring agents)
- Java-based admin tools invoking scripts as part of normal operation
level: high
tags:
- attack.t1190
- attack.t1059
id: ed235431-de2e-5d46-9da5-045cc0fc338a
status: experimental
author: Vorant
Java Process Spawning Download Utility (Log4Shell Second-Stage Retrieval)
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects a Java process invoking common download utilities (curl, wget, certutil) to retrieve a second-stage payload, consistent with post-exploitation of Log4j RCE Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Java Process Spawning Download Utility
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage|endswith:
- \java.exe
- \javaw.exe
selection_cmd:
Image|endswith:
- \curl.exe
- \wget.exe
- \certutil.exe
- \bitsadmin.exe
CommandLine|contains:
- http://
- https://
condition: selection and selection_cmd
falsepositives:
- Java-based deployment or update tools that legitimately fetch remote artifacts during
normal operation
level: medium
tags:
- attack.t1059
- attack.t1190
id: b1d1e011-fc04-5ace-b04c-94daeeabc468
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.ipa.go.jp/archive/security/security-alert/2021/alert20211213.html
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,433 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs