- 필수 기능
- 앱 내
- 서비스 관리
- 인프라스트럭처
- 애플리케이션 성능
- 디지털 경험
- 소프트웨어 제공
- 보안
- 로그 관리
- 관리
- 인프라스트럭처
- ci
- containers
- csm
- ndm
- otel_guides
- overview
- slos
- synthetics
- tests
- 워크플로
Tactic:
Detect successful exploits of the Log4shell vulnerability (CVE-2021-44228).
The vulnerability has CVSS Score: 10.0 CRITICAL and can lead to Remote Code Execution (RCE).
Monitor payloads matching known patterns for CVE-2021-44228 (event rule: #sqr-000-017 ) and lookup for HTTP requests to load a Java class.
Generate an Application Security signal with CRITICAL
severity.
Consider blocking the attacking IP(s) temporarily to prevent them to reach deeper parts of your production systems.
Considering the targeted application uses a vulnerable version of log4j and the default settings are disabled:
formatMsgNoLookups=true
. Only available from log4j >= 2.10 versionsorg.apache.logging.log4j.core.lookup.JndiLookup