Elastic – Apache Log4j 漏洞官方建議處置

Elastic 產品資訊產品資訊 2021 年 12 月 27 日 最後更新時間 : 2024 年 1 月 19 日

內容目錄

歐立威科技整理 Elastic官方針對本次 Log4j 漏洞的影響與建議的處置，更多關於本次漏洞訊息及其他產品處置請參考 Apache Log4j 漏洞事件說明與建議處置。

【前情提要】

2021年12月9日，Apache Log4j 被揭漏有重大風險漏洞 Log4Shell，漏洞編號 CVE-2021-44228。駭客可以利用該漏洞發動遠端程式碼執行攻擊，最嚴重可以接管整台系統，影響範圍擴及 Apache Log4j 2 中 logging library 的多個版本，資安專家稱為近 10 年來最嚴重漏洞，研究人員也發現已經有針對該漏洞的攻擊行動。

透過 Elastic Security 檢測 Log4Shell 漏洞

Elastic Security 用戶可以使用事件關聯 (Event Correlation) 檢測規則來識別 Log4j2 漏洞，根據基於主機的事件的(the host based event)資料格式，您可能需要修改此檢測以符合資料欄位。

使用端點數據(Endpoint data)時的檢測規則

sequence by host.id with maxspan=1m
 [network where event.action == "connection_attempted" and
  process.name : "java" and
  /*
     outbound connection attempt to
     LDAP, RMI or DNS standard ports
     by JAVA process
   */
  destination.port in (1389, 389, 1099, 53, 5353)] by process.pid
 [process where event.type == "start" and
  /* Suspicious JAVA child process */
  process.parent.name : "java" and
   process.name : ("sh",
                   "bash",
                   "dash",
                   "ksh",
                   "tcsh",
                   "zsh",
                   "curl",
                   "perl*",
                   "python*",
                   "ruby*",
                   "php*",
                   "wget")] by process.parent.pid

使用 Auditbeat 數據時的檢測規則

sequence by agent.id with maxspan=1m
 [network where event.action == "connected-to" and
  process.name : "java" and
  /*
     outbound connection attempt to
     LDAP, RMI or DNS standard ports
     by JAVA process
   */
  destination.port in (1389, 389, 1099, 53, 5353)] by process.pid
 [process where event.type == "start" and
  /* Suspicious JAVA child process */
  process.parent.name : "java" and
   process.name : ("sh",
                   "bash",
                   "dash",
                   "ksh",
                   "tcsh",
                   "zsh",
                   "curl",
                   "perl*",
                   "python*",
                   "ruby*",
                   "php*",
                   "wget")] by process.parent.pid

使用 Endgame 流事件(streamed events)時的檢測規則

sequence by agent.id with maxspan=1m
 [network where event.category == "network" and
  process.name : "java" and
  /*
     outbound connection attempt to
     LDAP, RMI or DNS standard ports
     by JAVA process
   */
  destination.port in (1389, 389, 1099, 53, 5353)] by process.pid
 [process where event.type == "start" and
  /* Suspicious JAVA child process */
  process.parent.name : "java" and
   process.name : ("sh",
                   "bash",
                   "dash",
                   "ksh",
                   "tcsh",
                   "zsh",
                   "curl",
                   "perl*",
                   "python*",
                   "ruby*",
                   "php*",
                   "wget")] by process.parent.pid

此檢測規則搜尋 LDAP、RMI 和 DNS 標準端口嘗試對外連接的序列（最常被觀察到的 JAVA/JNDI 攻擊方式），然後是同一 Java 實例的子進程(child process)。