Log4Shell-IOCs

Members of the Curated Intelligence Trust Group have compiled a list of IOC feeds and threat reports focused on the recent Log4Shell exploit targeting CVE-2021-44228 in Log4j. (Blog | Twitter | LinkedIn)

Analyst Comments:

• 2021-12-13
  • IOCs shared by these feeds are LOW-TO-MEDIUM CONFIDENCE we strongly recommend NOT adding them to a blocklist
  • These could potentially be used for THREAT HUNTING and could be added to a WATCHLIST
  • Curated Intel members at various organisations recommend to FOCUS ON POST-EXPLOITATION ACTIVITY by threats leveraging Log4Shell (ex. threat actors, botnets)
  • IOCs include JNDI requests (LDAP, but also DNS and RMI), cryptominers, DDoS bots, as well as Meterpreter or Cobalt Strike
  • Critical IOCs to monitor also include attacks using DNS-based exfiltration of environment variables (e.g. keys or tokens), a Curated Intel member shared an example
• 2021-12-14
  • Curated Intel members profiled active exploitation threats
• 2021-12-15
  • Curated Intel members parsed MEDIUM CONFIDENCE FEEDS to be MISP COMPATIBLE with the help of the KPMG-Egyde CTI Team
  • Curated Intel members profiled active threat groups (nation states and organized crime)
• 2021-12-16
  • Curated Intel members confirmed the previously unnamed "New Ransomware" is actually "TellYouThePass Ransomware", mostly targeting Chinese infrastructure
• 2021-12-17
  • Curated Intel members parsed VETTED IOCs with the help of the Equinix Threat Analysis Center (ETAC)
  • ETAC has also shared a diagram of threat actors, malware, and botnets, leveraging Log4Shell in the wild
• 2021-12-20
  • ETAC has added MITRE ATT&CK TTPs of Threat Actors leveraging Log4Shell
  • Curated Intel members parsed ALIENVAULT OTX MENTIONS to be MISP COMPATIBLE with the help of the KPMG-Egyde CTI Team
• 2021-12-21
  • Curated Intel members parsed VULNERABLE PRODUCT LISTS to be CSV+XLSX COMPATIBLE with an automated workflow, pulling from NCSC-NL + CISA + SwitHak

Indicators of Compromise (IOCs)

Threat Reports

Payload Examples

Threat Profiling

Threat Groups