Added Detection examples

justmurphy · Dec 21, 2021 · 3d49a26 · 3d49a26
1 parent 52a52fa
commit 3d49a26
Show file tree

Hide file tree

Showing 10 changed files with 23 additions and 0 deletions.
diff --git a/detection_mitigation/Examples/Generic_LDAP_bind.pcap b/detection_mitigation/Examples/Generic_LDAP_bind.pcap
diff --git a/detection_mitigation/Examples/Generic_RMI_call.pcap b/detection_mitigation/Examples/Generic_RMI_call.pcap
diff --git a/detection_mitigation/Examples/Generic_RMI_serialized_data.pcap b/detection_mitigation/Examples/Generic_RMI_serialized_data.pcap
diff --git a/detection_mitigation/Examples/JNDI-Exploit-Kit_HTTP_succesful_connection.pcap b/detection_mitigation/Examples/JNDI-Exploit-Kit_HTTP_succesful_connection.pcap
diff --git a/detection_mitigation/Examples/JNDI-Exploit-Kit_LDAP_serialized_data.pcap b/detection_mitigation/Examples/JNDI-Exploit-Kit_LDAP_serialized_data.pcap
diff --git a/detection_mitigation/Examples/jndiExploit_HTTP_succesful_connection.pcap b/detection_mitigation/Examples/jndiExploit_HTTP_succesful_connection.pcap
diff --git a/detection_mitigation/Examples/jndiExploit_LDAP_malicious_class.pcap b/detection_mitigation/Examples/jndiExploit_LDAP_malicious_class.pcap
diff --git a/detection_mitigation/Examples/jndiExploit_LDAP_serialized_data.pcap b/detection_mitigation/Examples/jndiExploit_LDAP_serialized_data.pcap
diff --git a/detection_mitigation/Examples/metadata_detection.txt b/detection_mitigation/Examples/metadata_detection.txt
@@ -0,0 +1,19 @@
+JNDIExploit
+http.method = 'GET'
+http.uri = '/Exploit[a-zA-Z0-9]{10}.class'
+http.user_agent = 'Java/.*' (depends on version installed on system)
+http.response_mime_type = 'application/x-java-applet'
+http.response_body = Java-class file (0xcafebabe00 file magic)
+
+JNDI-Exploit-Kit
+http.method = 'GET'
+http.uri = '/ExecTemplateJDK[5678].class'
+User-agent = 'Java/.*' (depends on version installed on system)
+http.response_mime_type = 'application/x-java-applet'
+http.response_body = Java-class file (0xcafebabe00 file magic)
+
+Marshallsec
+http.uri = '*.class'
+http.user_agent = 'Java/.*' (depends on version installed on system)
+http.response_mime_type = 'application/x-java-applet'
+http.response_body = Java-class file (0xcafebabe00 file magic)
diff --git a/detection_mitigation/Examples/rules.txt b/detection_mitigation/Examples/rules.txt
@@ -0,0 +1,4 @@
+alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"Detection - Log4j LDAP searchResEntry response with javaSerializedData - JNDI-Exploit-Kit"; content:"|30|"; depth:1; content:"|64|"; within:8; content:"javaSerializedData"; content: "javaCodeBase"; content: "http"; within:8; content:"javaClassName"; sid:21122001; priority:1;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"Detection - Log4j LDAP response with JNDIExploit framework attributes"; content:"|30|"; depth:1; content:"|64|"; within:8; content:"javaClassName"; content:"javaCodeBase"; content:"http"; within:8; content:"objectClass"; content:"javaFactory"; sid:21122002; priority:1;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"Detection - Log4j LDAP searchResEntry response with javaSerializedData - JNDIExploit"; content:"|30|"; depth:1; content:"|64|"; within:8; content: "javaClassName"; content:"javaSerializedData"; sid:21122003; priority:1;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"Detection - Log4J RMI ReturnData with Java Serialized Object"; content:"|51 ac ed 00 05|"; depth:5; sid:21122004; priority:2;)