You can use these commands and rules to search for exploitation attempts against log4j RCE vulnerability CVE-2021-44228
This command searches for exploitation attempts in uncompressed files in folder /var/log and all sub folders
sudo egrep -I -i -r '\$(\{|%7B)jndi:(ldap[s]?|rmi|dns|nis|iiop|corba|nds|http):/[^\n]+' /var/log
| using namespace System.Collections.Generic | |
| # Encapsulate an arbitrary command | |
| class PaneCommand { | |
| [string]$Command | |
| PaneCommand() { | |
| $this.Command = ""; | |
| } |
| # Warning | |
| Clear-Host | |
| Write-Output "Run this script on the computer you want to access via RDP" | |
| Write-Output "" | |
| # Ask | |
| Write-Output "Remote address can be an IP address or network with CIDR" | |
| Write-Output "Example: 192.168.0.5 or 192.168.0.0/24" | |
| Write-Output "" | |
| $RemoteAddress = Read-Host "Remote Address" |