對Log4Shell CVE-2021-44228 應急響應

PCRE RegEx 在您的日志中匹配 Log4Shell CVE-2021-44228 IOC

正則表達式：

(? im ) (?: ^ | [  ] )。* ? (?: [ \x 24 ] | % (?: 25%? ) * 24 | \\ u?0 * (?: 44 | 24 ) ) (?: [ \x 7b ] | % (?: 25%? ) * 7b | \\ u?0 * (?: 7b | 173 ) ) [^  ] * ? ( (?: j | % (?: 25%? ) * (?: 4a | 6a ) | \\ u?0 * (?: 112 | 6a | 4a | 152 ) ) [ ^  ] * ? (? : n | % (?: 25%? ) * (?: 4e | 6e ) | \\ u?0 * (?: 4e| 156 | 116 | 6e ) ) [ ^  ] * ? (?: d | % (?: 25%? ) * (?: 44 | 64 ) | \\ u?0 * (?: 44 | 144 | 104 | 64 ) ) [ ^  ] * ? (?: [ i \x {130} \x {131} ] | % (?:25%？) * (?: 49 | 69 | C4% (?: 25%? ) * B0 | C4% (?: 25%? ) * B1 ) | \\ u?0 * (?: 111 | 69 | 49 | 151 | 130 | 460 | 131 | 461 ) ) [ ^  ] * ? (?: [ \x 3a ] | %(?: 25%? ) * 3a | \\ u?0 * (?: 72 | 3a ) ) [ ^  ] * ? ( (?: l | % (?: 25%? ) * (?: 4c | 6c ) | \\ u?0 * (?: 154 | 114 | 6c | 4c ) ) [ ^  ] * ? (? : d |% (?: 25%? ) * (?: 44 | 64 ) | \\ u?0 * (?: 44 | 144 | 104 | 64 ) ) [ ^  ] * ? (?: a | % (?: 25%? ) * (?: 41 | 61 ) | \\ u?0 * (?: 101 | 61 | 41 | 141 ) ) [^  ] * ? (?: p | % (?: 25%? ) * (?: 50 | 70 ) | \\ u?0 * (?: 70 | 50 | 160 | 120 ) ) (?: [ ^  ] * ? (?: [ s \x {17f} ] | % (?: 25%? ) * (?: 53 | 73 | C5% (?:25%？) * BF ) | \\ u?0 * (?: 17f | 123 | 577 | 73 | 53 | 163 ) ) ) ? | (?: r | % (?: 25%? ) * (?: 52 | 72 ) | \\ u?0 * (?: 122 | 72 | 52 | 162 ) ) [ ^  ] *? (?: m | % (?: 25%? ) * (?: 4d | 6d ) | \\ u?0 * (?: 4d | 155 | 115 | 6d ) ) [ ^  ] * ? (?: [ i \x {130} \x {131} ] | % (?: 25%? ) * (?: 49 | 69 | C4% (?: 25%? )* B0 | C4% (?: 25%? ) * B1 ) | \\ u?0 * (?: 111 | 69 | 49 | 151 | 130 | 460 | 131 | 461 ) ) | (?: d | % (?: 25%? ) * (?: 44 | 64 ) | \\ u?0 * (?: 44 | 144 | 104 |64 ) ) [ ^  ] *？(?: n | % (?: 25%? ) * (?: 4e | 6e ) | \\ u?0 * (?: 4e | 156 | 116 | 6e ) ) [ ^  ] * ? (?: [ s \x {17f} ] | % (?: 25%? ) * (?: 53 | 73| C5% (?: 25%? ) * BF ) | \\ u?0 * (?: 17f | 123 | 577 | 73 | 53 | 163 ) ) | (?: n | % (?: 25%? ) * (?: 4e | 6e ) | \\ u?0 * (?: 4e | 156 | 116 | 6e ) ) [ ^  ]* ? (?: [ i \x {130} \x {131} ] | % (?: 25%? ) * (?: 49 | 69 | C4% (?: 25%? ) * B0 | C4% (?: 25%? ) * B1 ) | \\ u?0 * (?: 111 | 69 | 49 | 151 | 130 | 460 | 131 | 461 ) )[ ^  ] * ? (?: [ s \x {17f} ] | % (?: 25%? ) * (?: 53 | 73 | C5% (?: 25%? ) * BF ) | \\ u?0 * (?: 17f | 123 | 577 | 73 | 53 | 163 ) ) | (?: [ ^  ] * ? (?: [i \x {130} \x {131} ] | % (?: 25%? ) * (?: 49 | 69 | C4% (?: 25%? ) * B0 | C4% (?: 25%? ) * B1 ) | \\ u?0 * (?: 111 | 69 | 49 | 151 | 130 | 460 | 131 | 461 ) ) ) { 2 }[ ^  ] * ? (?: o | % (?: 25%? ) * (?: 4f | 6f ) | \\ u?0 * (?: 6f | 4f | 157 | 117 ) ) [ ^  ] * ? (?: p | % (?: 25%? ) * (?: 50 | 70 ) | \\ u?0 * (?: 70| 50 | 160 | 120 ））| (?: c | % (?: 25%? ) * (?: 43 | 63 ) | \\ u?0 * (?: 143 | 103 | 63 | 43 ) ) [ ^  ] * ? (?: o | % (?: 25%? ) * (?: 4f | 6f ) | \\ u?0* (?: 6f | 4f | 157 | 117 ) ) [ ^  ] * ? (?: r | % (?: 25%? ) * (?: 52 | 72 ) | \\ u?0 * (?: 122 | 72 | 52 | 162 ) ) [ ^  ] * ? (?: b | % (?: 25%? ) *(?: 42 | 62 ) | \\ u?0 * (?: 102 | 62 | 42 | 142 ) ) [ ^  ] * ? (?: a | % (?: 25%? ) * (?: 41 | 61 ) | \\ u?0 * (?: 101 | 61 | 41 | 141 ) ) | (?: n | % (?:25%？) * (?: 4e | 6e ) | \\ u?0 * (?: 4e | 156 | 116 | 6e ) ) [ ^  ] * ? (?: d | % (?: 25%? ) * (?: 44 | 64 ) | \\ u?0 * (?: 44 | 144 | 104 | 64 ) ) [ ^ ] * ? (?: [ s \x {17f} ] | % (?: 25%? ) * (?: 53 | 73 | C5% (?: 25%? ) * BF ) | \\ u?0 * (?: 17f | 123 | 577 | 73 | 53 | 163 ) ) | (?: h | % (?: 25%? ) * (?: 48 |68 ) | \\ u?0 * (?: 110 | 68 | 48 | 150 ) ) (?: [ ^  ] * ? (?: t | % (?: 25%? ) * (?: 54 | 74 ) | \\ u?0 * (?: 124 | 74 | 54 | 164 ) ) ) { 2 } [ ^  ]* ? (?: p | % (?: 25%? ) * (?: 50 | 70 ) | \\ u?0 * (?: 70 | 50 | 160 | 120 ) ) (?: [ ^  ] * ? (?: [ s \x {17f} ] | % (?: 25%? ) * (?: 53 | 73 | C5% (?: 25%? ) *BF ) | \\ u?0 * (?: 17f | 123 | 577 | 73 | 53 | 163 ) ) ) ? ) [ ^  ] * ? (?: [ \x 3a ] | % (?: 25%? ) * 3a | \\ u?0 * (?: 72 | 3a ) ) | (?: b | % (?: 25%?) * (?: 42 | 62 ) | \\ u?0 * (?: 102 | 62 | 42 | 142 ) ) [ ^  ] * ? (?: a | % (?: 25%? ) * (?: 41 | 61 ) | \\ u?0 * (?: 101 | 61 | 41 | 141 ) ) [ ^  ]* ? (?: [ s \x {17f} ] | % (?: 25%? ) * (?: 53 | 73 | C5% (?: 25%? ) * BF ) | \\ u?0 * (?: 17f | 123 | 577 | 73 | 53 | 163 ) ) [ ^  ] * ? (?: e | % (?: 25%? ) *(?: 45 | 65 ) | \\ u?0 * (?: 45 | 145 | 105 | 65 ) ) [ ^  ] * ? (?: [ \x 3a ] | % (?: 25%? ) * 3a | \\ u?0 * (?: 72 | 3a ) ) ( JH [ sv ] | [ \x 2b \x 2f-9A-扎-z] [ CSiy ] R7 | [ \x 2b \x 2f-9A-Za-z ] { 2 } [ 048AEIMQUYcgkosw ] ke [ \x 2b \x 2f-9w-z ] ) )

這個正則表達式匹配漏洞利用：

不區分大小寫（也在所有支持的編碼中）
Url編碼
遞歸 URL 編碼
使用 Unicode 編碼
八進制編碼
Base64 編碼

Linux 機器上使用

在 CLI 上 `grep`

eval  " $( ./RegEx_Generator.sh ) " 
grep -P ${Log4ShellRex}  
grep -P '(?im)(?:^|[]).*?(?:[\x24]|%(?:25%?)*24|\\u?0*(?:44 |24))(?:[\x7b]|%(?:25%?)*7b|\\u?0*(?:7b|173))[^]*?((?:j| %(?:25%?)*(?:4a|6a)|\\u?0*(?:112|6a|4a|152))[^]*?(?:n|%(? :25%?)*(?:4e|6e)|\\u?0*(?:4e|156|116|6e))[^]*?(?:d|%(?:25%) ?)*(?:44|64)|\\u?0*(?:44|144|104|64))[^]*?(?:[i\x{130}\x{131 }]|%(?:25%?)*(?:49|69|C4%(?:25%?)*B0|C4%(?:25%?)*B1)|\\u?0* (?:111|69|49|151|130|460|131|461))[^]*?(?:[\x3a]|%(?:25%?)*3a|\\u? 0*(?:72|3a))[^]*?((?:l|%(?:25%?)*(?:4c|6c)|\\u?0*(?:154 |114|6c|4c))[^]*?(?:d|%(?:25%?)*(?:44|64)|\\u?0*(?:44|144| 104|64))[^]*?(?:a|%(?:25%?)*(?:41|61)|\\u?0*(?:101|61|41|141 ))[^]*?(?:p|%(?:25%?)*(?:50|70)|\\u?0*(?:70|50|160|120))( ?:[^]*?(?:[s\x{17f}]|%(?:25%?)*(?:53|73|C5%(?:25%?)*BF)| \\u?0*(?:17f|123|577|73|53|163)))?|(?:r|%(?:25%?)*(?:52|72)|\\u ?0*(?:122|72|52|162))[^]*?(?:m|%(?:25%?)*(?:4d|6d)|\\u?0* （？：4d|155|115|6d))[^]*?(?:[i\x{130}\x{131}]|%(?:25%?)*(?:49|69|C4 %(?:25%?)*B0|C4%(?:25%?)*B1)|\\u?0*(?:111|69|49|151|130|460|131|461)) |(?:d|%(?:25%?)*(?:44|64)|\\u?0*(?:44|144|104|64))[^]*?(? :n|%(?:25%?)*(?:4e|6e)|\\u?0*(?:4e|156|116|6e))[^]*?(?:[s \x{17f}]|%(?:25%?)*(?:53|73|C5%(?:25%?)*BF)|\\u?0*(?:17f|123|577 |73|53|163))|(?:n|%(?:25%?)*(?:4e|6e)|\\u?0*(?:4e|156|116|6e))[ ^]*?(?:[i\x{130}\x{131}]|%(?:25%?)*(?:49|69|C4%(?:25%?)*B0 |C4%(?:25%?)*B1)|\\u?0*(?:111|69|49|151|130|460|131|461))[^]*?(?: [s\x{17f}]|%(?:25%?)*(?:53|73|C5%(?:25%?)*BF)|\\u?0*(?:17f|123 |577|73|53|163))|(?:[^]*?(?:[i\x{130}\x{131}]|%(?:25%?)*(?: 49|69|C4%(?:25%?)*B0|C4%(?:25%?)*B1)|\\u?0*(?:111|69|49|151|130|460| 131|461))){2}[^]*?(?:o|%(?:25%?)*(?:4f|6f)|\\u?0*(?:6f|4f |157|117))[^]*?(?:p|%(?:25%?)*(?:50|70)|\\u?0*(?:70|50|160| 120))|(?:c|%(?:25%?)*(?:43|63)|\\u?0*(?:143|103|63|43))[^]*?(?:o|%(?:25%?)*(?:4f|6f)|\\u?0*(?:6f|4f |157|117))[^]*?(?:r|%(?:25%?)*(?:52|72)|\\u?0*(?:122|72|52| 162))[^]*?(?:b|%(?:25%?)*(?:42|62)|\\u?0*(?:102|62|42|142)) [^]*?(?:a|%(?:25%?)*(?:41|61)|\\u?0*(?:101|61|41|141))|(? :n|%(?:25%?)*(?:4e|6e)|\\u?0*(?:4e|156|116|6e))[^]*?(?:d| %(?:25%?)*(?:44|64)|\\u?0*(?:44|144|104|64))[^]*?(?:[s\x{ 17f}]|%(?:25%?)*(?:53|73|C5%(?:25%?)*BF)|\\u?0*(?:17f|123|577|73| 53|163))|(?:h|%(?:25%?)*(?:48|68)|\\u?0*(?:110|68|48|150))(?:[ ^]*?(?:t|%(?:25%?)*(?:54|74)|\\u?0*(?:124|74|54|164))){2} [^]*?(?:p|%(?:25%?)*(?:50|70)|\\u?0*(?:70|50|160|120))(?: [^]*?(?:[s\x{17f}]|%(?:25%?)*(?:53|73|C5%(?:25%?)*BF)|\\ u?0*(?:17f|123|577|73|53|163)))?)[^]*?(?:[\x3a]|%(?:25%?)*3a|\ \u?0*(?:72|3a))|(?:b|%(?:25%?)*(?:42|62)|\\u?0*(?:102|62|42 |142))[^]*?(?:a|%(?:25%?)*(?:41|61)|\\u?0*(?:101|61|41|141) )[^]*?(?:[s\x{17f}]|%(?:25%?)*(?:53|73|C5%(?:25%?)*BF)|\\u?0*(?:17f|123 |577|73|53|163))[^]*?(?:e|%(?:25%?)*(?:45|65)|\\u?0*(?:45| 145|105|65))[^]*?(?:[\x3a]|%(?:25%?)*3a|\\u?0*(?:72|3a))(JH[ sv]|[\x2b\x2f-9A-Za-z][CSiy]R7|[\x2b\x2f-9A-Za-z]{2}[048AEIMQUYcgkosw]ke[\x2b\x2f-9w-z]) )' <logfile>

使用 Splunk 搜索您的日志

您可以使用此 RegEx 使用| regex SPL命令搜索索引日志

index=<...> sourcetype=<...>
| regex "<Log4ShellRex>"
index=<...> sourcetype=<...>
| regex "(?im)(?:^|[\]).*?(?:[\\x24]|%(?:25%?)*24|\\\\u?0*(?:44|24))(?:[\\x7b]|%(?:25%?)*7b|\\\\u?0*(?:7b|173))[^\]*?((?:j|%(?:25%?)*(?:4a|6a)|\\\\u?0*(?:112|6a|4a|152))[^\]*?(?:n|%(?:25%?)*(?:4e|6e)|\\\\u?0*(?:4e|156|116|6e))[^\]*?(?:d|%(?:25%?)*(?:44|64)|\\\\u?0*(?:44|144|104|64))[^\]*?(?:[i\\x{130}\\x{131}]|%(?:25%?)*(?:49|69|C4%(?:25%?)*B0|C4%(?:25%?)*B1)|\\\\u?0*(?:111|69|49|151|130|460|131|461))[^\]*?(?:[\\x3a]|%(?:25%?)*3a|\\\\u?0*(?:72|3a))[^\]*?((?:l|%(?:25%?)*(?:4c|6c)|\\\\u?0*(?:154|114|6c|4c))[^\]*?(?:d|%(?:25%?)*(?:44|64)|\\\\u?0*(?:44|144|104|64))[^\]*?(?:a|%(?:25%?)*(?:41|61)|\\\\u?0*(?:101|61|41|141))[^\]*?(?:p|%(?:25%?)*(?:50|70)|\\\\u?0*(?:70|50|160|120))(?:[^\]*?(?:[s\\x{17f}]|%(?:25%?)*(?:53|73|C5%(?:25%?)*BF)|\\\\u?0*(?:17f|123|577|73|53|163)))?|(?:r|%(?:25%?)*(?:52|72)|\\\\u?0*(?:122|72|52|162))[^\]*?(?:m|%(?:25%?)*(?:4d|6d)|\\\\u?0*(?:4d|155|115|6d))[^\]*?(?:[i\\x{130}\\x{131}]|%(?:25%?)*(?:49|69|C4%(?:25%?)*B0|C4%(?:25%?)*B1)|\\\\u?0*(?:111|69|49|151|130|460|131|461))|(?:d|%(?:25%?)*(?:44|64)|\\\\u?0*(?:44|144|104|64))[^\]*?(?:n|%(?:25%?)*(?:4e|6e)|\\\\u?0*(?:4e|156|116|6e))[^\]*?(?:[s\\x{17f}]|%(?:25%?)*(?:53|73|C5%(?:25%?)*BF)|\\\\u?0*(?:17f|123|577|73|53|163))|(?:n|%(?:25%?)*(?:4e|6e)|\\\\u?0*(?:4e|156|116|6e))[^\]*?(?:[i\\x{130}\\x{131}]|%(?:25%?)*(?:49|69|C4%(?:25%?)*B0|C4%(?:25%?)*B1)|\\\\u?0*(?:111|69|49|151|130|460|131|461))[^\]*?(?:[s\\x{17f}]|%(?:25%?)*(?:53|73|C5%(?:25%?)*BF)|\\\\u?0*(?:17f|123|577|73|53|163))|(?:[^\]*?(?:[i\\x{130}\\x{131}]|%(?:25%?)*(?:49|69|C4%(?:25%?)*B0|C4%(?:25%?)*B1)|\\\\u?0*(?:111|69|49|151|130|460|131|461))){2}[^\]*?(?:o|%(?:25%?)*(?:4f|6f)|\\\\u?0*(?:6f|4f|157|117))[^\]*?(?:p|%(?:25%?)*(?:50|70)|\\\\u?0*(?:70|50|160|120))|(?:c|%(?:25%?)*(?:43|63)|\\\\u?0*(?:143|103|63|43))[^\]*?(?:o|%(?:25%?)*(?:4f|6f)|\\\\u?0*(?:6f|4f|157|117))[^\]*?(?:r|%(?:25%?)*(?:52|72)|\\\\u?0*(?:122|72|52|162))[^\]*?(?:b|%(?:25%?)*(?:42|62)|\\\\u?0*(?:102|62|42|142))[^\]*?(?:a|%(?:25%?)*(?:41|61)|\\\\u?0*(?:101|61|41|141))|(?:n|%(?:25%?)*(?:4e|6e)|\\\\u?0*(?:4e|156|116|6e))[^\]*?(?:d|%(?:25%?)*(?:44|64)|\\\\u?0*(?:44|144|104|64))[^\]*?(?:[s\\x{17f}]|%(?:25%?)*(?:53|73|C5%(?:25%?)*BF)|\\\\u?0*(?:17f|123|577|73|53|163))|(?:h|%(?:25%?)*(?:48|68)|\\\\u?0*(?:110|68|48|150))(?:[^\]*?(?:t|%(?:25%?)*(?:54|74)|\\\\u?0*(?:124|74|54|164))){2}[^\]*?(?:p|%(?:25%?)*(?:50|70)|\\\\u?0*(?:70|50|160|120))(?:[^\]*?(?:[s\\x{17f}]|%(?:25%?)*(?:53|73|C5%(?:25%?)*BF)|\\\\u?0*(?:17f|123|577|73|53|163)))?)[^\]*?(?:[\\x3a]|%(?:25%?)*3a|\\\\u?0*(?:72|3a))|(?:b|%(?:25%?)*(?:42|62)|\\\\u?0*(?:102|62|42|142))[^\]*?(?:a|%(?:25%?)*(?:41|61)|\\\\u?0*(?:101|61|41|141))[^\]*?(?:[s\\x{17f}]|%(?:25%?)*(?:53|73|C5%(?:25%?)*BF)|\\\\u?0*(?:17f|123|577|73|53|163))[^\]*?(?:e|%(?:25%?)*(?:45|65)|\\\\u?0*(?:45|145|105|65))[^\]*?(?:[\\x3a]|%(?:25%?)*3a|\\\\u?0*(?:72|3a))(JH[s-v]|[\\x2b\\x2f-9A-Za-z][CSiy]R7|[\\x2b\\x2f-9A-Za-z]{2}[048AEIMQUYcgkosw]ke[\\x2b\\x2f-9w-z]))"

grep -P

Splunk

Linux 機器上使用

在 CLI 上 grep

使用 Splunk 搜索您的日志

在 CLI 上 `grep`