Hunting for log4shell Compromises
summary
Two post-disclosure compromise assessments run across a healthcare and an energy org find thousands of probing attempts but only ~50 successful web responses (HTTP 200); no confirmed log4shell follow-on payloads are observed. Detection uses web server logs, EDR, and especially firewall outbound logs because firewall logs outperform EDR for outbound tracing; analysts deploy regex-based iterative hunting on centralized and on-source logs, provision forensic workstations, and correlate timestamps to prioritize assets, which proves effective at scale.
AI-written summary · about
chapters (20)
- 0:00Intro
- 1:39Log4Shell is the Grinch
- 4:38Apache Log4j is everywhere
- 5:18Timeline
- 7:00How Loj4shell works
- 8:18Compromise assessment vs threat hunting
- 9:27How to start
- 11:02Iterative approach
- 11:57Final rule
- 12:40Filtering hits
- 14:19Different folks, (mostly) same approach
- 15:06Organization 1: old school but still cool
- 16:48Organization 1: investigation results
- 18:11Organization 2: one body a hundred heads
- 20:44Organization 2: adapt and overcome
- 21:47Organization 2: investigation results
- 22:54Avulnerability for years to come
- 24:13Acknowledgments and indictments
- 25:14Elastich Search Queries
- 25:32PaloAlto Panorama Query
related talks
25mDevSecOps by Default: What have, can and must we learn from Log4Shell?
51mLog4Shell Armageddon or Opportunity
46mThe Next Log4jshell?! Preparing for CVEs with eBPF!
51mDouble plus Ungood Why Log4Shell Is So Bad
43mThreat hunting in the cloud
40mHunt and Gather: Developing Effective Threat Hunting Techniques
33mLog4J, SpringShell and all that Jazz (or why bad things can happen to good software)
29mHunting and Stopping Threats with Elastic Security