Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
CVE coverage

CVE-2021-44228

CVSS 10.0 Actively exploited (KEV) 20 detections found
View on NVD →
Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0 (along with 2.12.2, 2.12.3, and 2.3.1), this functionality has been completely removed. Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects.

Detection rules

Source Rule Status Updated
splunk Log4Shell JNDI Payload Injection Attempt production 2026-09-08
splunk Log4Shell JNDI Payload Injection with Outbound Connection production 2026-09-08
splunk File Download or Read to Pipe Execution production 2026-09-01
splunk CMD Carry Out String Command Parameter production 2026-05-13
splunk Java Class File download by Java User Agent production 2026-05-13
splunk Outbound Network Connection from Java Using Default Ports production 2026-05-13
splunk Detect Outbound LDAP Traffic production 2026-05-13
splunk Hunting for Log4Shell production 2026-05-13
splunk Log4Shell CVE-2021-44228 Exploitation production 2026-05-13
sigma Log4j RCE CVE-2021-44228 in Fields test 2023-01-02
sigma Log4j RCE CVE-2021-44228 Generic test 2022-02-06
sigma Potential CVE-2021-44228 Exploitation Attempt - VMware Horizon test 2022-01-14
suricata ET INFO Serialized Java Object returned via LDAPv3 Response rev 2 2021-12-21
snort ET POLICY Serialized Java Object returned via LDAPv3 Response rev 2 2021-12-21
snort ET ATTACK_RESPONSE Possible CVE-2021-44228 Payload via LDAPv3 Response M2 rev 2 2021-12-20
suricata ET ATTACK_RESPONSE Possible CVE-2021-44228 Payload via LDAPv3 Response M2 rev 2 2021-12-20
suricata ET ATTACK_RESPONSE Possible CVE-2021-44228 Payload via LDAPv3 Response rev 1 2021-12-14
snort ET ATTACK_RESPONSE Possible CVE-2021-44228 Payload via LDAPv3 Response rev 1 2021-12-14
sentinel Vulnerable Machines related to log4j CVE-2021-44228 — —
sentinel Azure WAF matching for Log4j vuln(CVE-2021-44228) — —