Update Hunting Queries/MultipleDataSources/NetworkConnectionldap_log4j.yaml
Co-authored-by: sergevanhaag <84989429+sergevanhaag@users.noreply.github.com>
This commit is contained in:
Родитель
a2c8dd8513
Коммит
fbea5ace5b
|
@ -3,7 +3,7 @@ name: Malicious Connection to LDAP port for CVE-2021-44228 vulnerability
|
|||
description: |
|
||||
'This hunting query looks for connection to the most common LDAP ports to find possible exploitation attempts for CVE-2021-44228 involving log4j vulnerability.
|
||||
The attack is not limited only to these ports. Log4j is an open-source Apache logging library that is used in many Java-based applications.
|
||||
Awarness of normal baseline traffic of an enviornment for java.exe while using this query will help detrmine normal from anaomalous.
|
||||
Awareness of normal baseline traffic of an environment for java.exe while using this query will help determine normal from anomalous.
|
||||
Refrence: https://www.microsoft.com/security/blog/2021/12/11/guidance-for-preventing-detecting-and-hunting-for-cve-2021-44228-log4j-2-exploitation/'
|
||||
requiredDataConnectors:
|
||||
- connectorId: MicrosoftThreatProtection
|
||||
|
|
Загрузка…
Ссылка в новой задаче