VORANT. Threat Intelligence Sign in Get the full feed

Apache Log4j remote code execution vulnerability (Log4jShell/CVE-2021-44228) actively…

critical vulnerability

Apache Log4j remote code execution vulnerability (Log4jShell/CVE-2021-44228) actively exploited; IPA Japan urges immediate patching to version 2.17.0 or 2.12.3.

Japan's Information-technology Promotion Agency (IPA) issued an advisory on a critical remote code execution vulnerability in Apache Log4j, a widely-used Java logging library. The vulnerability allows remote attackers to execute arbitrary commands by sending specially crafted data to vulnerable systems. IPA reports that exploitation attempts have been observed domestically within Japan, with attacks detected against systems using affected versions.

Affected versions include Apache Log4j 2.x prior to 2.15.0 (excluding 2.12.2 and later in the 2.12 branch). While Log4j 1.x was initially believed unaffected due to lack of Lookup functionality, IPA notes certain configurations may still be vulnerable. The agency emphasizes that earlier mitigations proved insufficient against specific attack vectors.

IPA strongly recommends immediate updates to version 2.17.0 (or 2.12.3 for the 2.12 branch), which address both the original vulnerability and related issue CVE-2021-45105. Organizations unable to patch immediately should implement workarounds and review egress access controls to limit potential impact. Product vendors using Log4j are expected to release their own advisories.

Mentioned in this report

Vulnerabilities CVE-2021-44228KEVCVE-2021-45105

Detection guidance

Suspicious Child Process Spawned from Java Process (Log4Shell Exploitation)

ATT&CK T1190

Detects a Java process spawning a command interpreter or shell, consistent with post-exploitation of Log4j RCE (Log4Shell) on a vulnerable application server Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Suspicious Child Process Spawned from Java Process
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith:
    - \java.exe
    - \javaw.exe
    - \javaw.exe
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
    - \bash.exe
    - \wscript.exe
    - \cscript.exe
    - \sh.exe
    - \mshta.exe
    - \rundll32.exe
    - \regsvr32.exe
  filter:
    CommandLine|contains:
    - GetJavaVersion
    - JavaUpdate
  condition: selection and not filter
falsepositives:
- Legitimate Java applications that intentionally shell out to system utilities (e.g.,
  build tools, monitoring agents)
- Java-based admin tools invoking scripts as part of normal operation
level: high
tags:
- attack.t1190
- attack.t1059
id: ed235431-de2e-5d46-9da5-045cc0fc338a
status: experimental
author: Vorant

JNDI Lookup Pattern in HTTP Request (Log4Shell Exploitation Attempt)

ATT&CK T1190

Detects HTTP request fields (URI, headers, User-Agent) containing jndi:ldap/rmi/dns lookup strings characteristic of Log4Shell exploitation attempts against public-facing applications Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: JNDI Lookup Pattern in HTTP Request
logsource:
  category: webserver
detection:
  selection:
    cs-uri-query|contains:
    - ${jndi:ldap://
    - ${jndi:rmi://
    - ${jndi:dns://
    - ${jndi:ldaps://
    - ${jndi:http://
    cs-user-agent|contains:
    - ${jndi:ldap://
    - ${jndi:rmi://
    - ${jndi:dns://
    cs-referrer|contains:
    - ${jndi:ldap://
    - ${jndi:rmi://
  condition: selection
falsepositives:
- Security scanners and vulnerability assessment tools actively probing for Log4Shell
  as part of authorized testing
- Threat intelligence honeypots deliberately logging exploitation attempts
level: high
tags:
- attack.t1190
id: e6c2662d-3ce3-5c7e-833f-641960452cee
status: experimental
author: Vorant

Java Process Spawning Download Utility (Log4Shell Second-Stage Retrieval)

ATT&CK T1059

Detects a Java process invoking common download utilities (curl, wget, certutil) to retrieve a second-stage payload, consistent with post-exploitation of Log4j RCE Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Java Process Spawning Download Utility
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith:
    - \java.exe
    - \javaw.exe
  selection_cmd:
    Image|endswith:
    - \curl.exe
    - \wget.exe
    - \certutil.exe
    - \bitsadmin.exe
    CommandLine|contains:
    - http://
    - https://
  condition: selection and selection_cmd
falsepositives:
- Java-based deployment or update tools that legitimately fetch remote artifacts during
  normal operation
level: medium
tags:
- attack.t1059
- attack.t1190
id: b1d1e011-fc04-5ace-b04c-94daeeabc468
status: experimental
author: Vorant

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.ipa.go.jp/archive/security/security-alert/2021/alert20211213.html

This is the public brief

Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.

Start free