Update Hunting Queries/MultipleDataSources/NetworkConnectionldap_log4j.yaml

Co-authored-by: sergevanhaag <84989429+sergevanhaag@users.noreply.github.com>
This commit is contained in:
aprakash13 2021-12-29 15:20:03 -08:00 коммит произвёл GitHub
Родитель a2c8dd8513
Коммит fbea5ace5b
Не найден ключ, соответствующий данной подписи
Идентификатор ключа GPG: 4AEE18F83AFDEB23
1 изменённых файлов: 1 добавлений и 1 удалений

Просмотреть файл

@ -3,7 +3,7 @@ name: Malicious Connection to LDAP port for CVE-2021-44228 vulnerability
description: |
'This hunting query looks for connection to the most common LDAP ports to find possible exploitation attempts for CVE-2021-44228 involving log4j vulnerability.
The attack is not limited only to these ports. Log4j is an open-source Apache logging library that is used in many Java-based applications.
Awarness of normal baseline traffic of an enviornment for java.exe while using this query will help detrmine normal from anaomalous.
Awareness of normal baseline traffic of an environment for java.exe while using this query will help determine normal from anomalous.
Refrence: https://www.microsoft.com/security/blog/2021/12/11/guidance-for-preventing-detecting-and-hunting-for-cve-2021-44228-log4j-2-exploitation/'
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection