Vulnerable Machines related to log4j CVE-2021-44228

Back


Id	3d71fc38-f249-454e-8479-0a358382ef9a
Rulename	Vulnerable Machines related to log4j CVE-2021-44228
Description	This query uses the Azure Defender Security Nested Recommendations data to find machines vulnerable to log4j CVE-2021-44228. Log4j is an open-source Apache logging library that is used in many Java-based applications. Security Nested Recommendations data is sent to Microsoft Sentinel using the continuous export feature of Azure Defender(refrence link below). Reference: https://msrc-blog.microsoft.com/2021/12/11/microsofts-response-to-cve-2021-44228-apache-log4j2/ Reference: https://docs.microsoft.com/azure/security-center/continuous-export?tabs=azure-portal Reference: https://techcommunity.microsoft.com/t5/microsoft-defender-for-cloud/how-defender-for-cloud-displays-machines-affected-by-log4j/ba-p/3037271
Severity	High
Tactics	InitialAccess Execution
Techniques	T1190 T1203
Kind	Scheduled
Query frequency	1d
Query period	1d
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Apache Log4j Vulnerability Detection/Analytic Rules/Log4jVulnerableMachines.yaml
Version	1.0.3
Arm template	3d71fc38-f249-454e-8479-0a358382ef9a.json

KQL

SecurityNestedRecommendation
| where RemediationDescription has 'CVE-2021-44228'
| parse ResourceDetails with * 'virtualMachines/' VirtualMachine '"' *
| summarize arg_min(TimeGenerated, *) by TenantId, RecommendationSubscriptionId, VirtualMachine, RecommendationName,Description,RemediationDescription, tostring(AdditionalData),VulnerabilityId
| extend Timestamp = TimeGenerated

YAML

description: |
  'This query uses the Azure Defender Security Nested Recommendations data to find machines vulnerable to log4j CVE-2021-44228.
  Log4j is an open-source Apache logging library that is used in many Java-based applications. Security Nested Recommendations data is sent to Microsoft Sentinel using the continuous export feature of Azure Defender(refrence link below).
   Reference: https://msrc-blog.microsoft.com/2021/12/11/microsofts-response-to-cve-2021-44228-apache-log4j2/
   Reference: https://docs.microsoft.com/azure/security-center/continuous-export?tabs=azure-portal
   Reference: https://techcommunity.microsoft.com/t5/microsoft-defender-for-cloud/how-defender-for-cloud-displays-machines-affected-by-log4j/ba-p/3037271'  
version: 1.0.3
triggerThreshold: 0
tactics:
- InitialAccess
- Execution
queryPeriod: 1d
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Apache Log4j Vulnerability Detection/Analytic Rules/Log4jVulnerableMachines.yaml
triggerOperator: gt
status: Available
id: 3d71fc38-f249-454e-8479-0a358382ef9a
name: Vulnerable Machines related to log4j CVE-2021-44228
queryFrequency: 1d
severity: High
kind: Scheduled
entityMappings:
- fieldMappings:
  - columnName: VirtualMachine
    identifier: HostName
  entityType: Host
relevantTechniques:
- T1190
- T1203
query: |
  SecurityNestedRecommendation
  | where RemediationDescription has 'CVE-2021-44228'
  | parse ResourceDetails with * 'virtualMachines/' VirtualMachine '"' *
  | summarize arg_min(TimeGenerated, *) by TenantId, RecommendationSubscriptionId, VirtualMachine, RecommendationName,Description,RemediationDescription, tostring(AdditionalData),VulnerabilityId
  | extend Timestamp = TimeGenerated  
tags:
- Log4j
- CVE-2021-44228
- Log4shell
requiredDataConnectors: []

ARM