URGENT: Analysis and Remediation Guidance to the Log4j Zero-Day RCE (CVE-2021-44228) Vulnerability

Updates:
30-Dec-2021: Clarified attack scenario for Log4j 1.x CVE-2021-4104
29-Dec-2021: Updated remediation guidance to include CVE-2021-44832
22-Dec-2021: Added details for the latest version of Log4J for Java 6 and Java 7
20-Dec-2021: Updated Am I affected, Remediation and Off-the-Shelf sections
17-Dec-2021: Added more details around CVE-2021-45046 and Log4j 2.15.0
16-Dec-2021: Added Organizational update priority section to plan for upgrade to 2.16
15-Dec-2021: Removed Mitigation using System properties or Environment Variables
15-Dec-2021: Additional details around vulnerability in 2.15.0
15-Dec-2021: More information around Log4j 1.x impact
14-Dec-2021: Updated reference to log4j 2.16.0
14-Dec-2021: Updated reference to vulnerability in SCA
13-Dec-2021: Removed JDK versions from affected list based on Márcio Almeida's work
13-Dec 2021: Added Log4j 1.x based recommendation
12-Dec-2021: Removed Java version-based recommendation
10-Dec-2021: Initial version
A previously unknown…

SecRule REQUEST_URI "@rx ..." "id:1001,phase:1,deny,status:403"

find /var/www -type f -name "*.php" -mmin -120

ss -tunp | grep -E ":(4444|1337|8080|9001)"

apt update && apt --only-upgrade install <pkg>

title: Detect Exploitation - URGENT: Analysis and Remediation Guidance to the Log4j Zero-Day RCE (CVE-2021-44228) Vulnerability
id: 79c6383d-9842-4ef8-9b41-6927450411de
status: experimental
description: Automatisch generierte SIEM-Erkennungsregel basierend auf CTI Intelligence
references:
  - https://tsecurity.de/
author: iShareStuff CTI Automated Detection Engine
date: 2026-09-24
logsource:
  category: network_connection
  product: any
detection:
  selection:
      CommandLine|contains:
        - 'exploit'
  condition: selection
falsepositives:
  - Legitime administrative Zugriffe oder Penetrationstests
level: high
tags:
  - attack.initial_access
  - attack.t1190

rule CTI_Threat_Indicator {
    meta:
        author = "iShareStuff CTI Automated Detection Engine"
        date = "2026-09-24"
        description = "YARA Signature for "
    strings:
        $str = "URGENT: Analysis and Remediati" ascii wide
    condition:
        any of them
}