Neo23x0

log4j RCE Exploitation Detection

You can use these commands and rules to search for exploitation attempts against log4j RCE vulnerability CVE-2021-44228

Grep / Zgrep

This command searches for exploitation attempts in uncompressed files in folder /var/log and all sub folders

sudo egrep -I -i -r '\$(\{|%7B)jndi:(ldap[s]?|rmi|dns|nis|iiop|corba|nds|http):/[^\n]+' /var/log

deeso

Soup to Nuts: Creating a Plaso Parser and Deploying Timesketch to Docker

Acknowledgements, etc.

Thank you to the Log2timeline and Timesketch teams for putting out some solid work. I am thankful that I have the opportunity to create this write up, which comes on the back of their hard work. While there may be holes in their documentation and descriptions, the code is well written and fairly easy to understand. Any criticism should not be interpretted as a reflection of the quality of their work.

404NetworkError

Windows Functions in Malware Analysis – Cheat Sheet

From InfoSec Institute, part 1 and part 2

Table of Contents

• Accept
• AdjustTokenPrivileges
• AttachThreadInput
• Bind
• BitBlt
• CertOpenSystemStore
• Connect