Coverage › CVE-2021-44228

CVE-2021-44228 Mapped Partial Sigma

Apache Log4j2 Remote Code Execution Vulnerability

Vendor / product

Apache — Log4j2

Description (CISA)

Apache Log4j2 contains a vulnerability where JNDI features do not protect against attacker-controlled JNDI-related endpoints, allowing for remote code execution.

Added to KEV

2021-12-10

Due date

2021-12-24

Required action

For all affected software assets for which updates exist, the only acceptable remediation actions are: 1) Apply updates; OR 2) remove affected assets from agency networks. Temporary mitigations using one of the measures provided at https://www.cisa.gov/uscert/ed-22-02-apache-log4j-recommended-mitigation-measures are only acceptable until updates are available.

Known ransomware use

Known

CWE

CWE-20, CWE-400, CWE-502

CISA notes

https://nvd.nist.gov/vuln/detail/CVE-2021-44228

Elsewhere

cve.org · NVD · CISA KEV · JSON

ATT&CK techniques · CTID Mappings Explorer, ATT&CK 16.1, KEV snapshot 2025-07-28

5 mapping objects across 5 techniques. exploitation technique states how the vulnerability is exploited; primary and secondary impact state what exploitation achieves. They are different claims and are labelled as such.

Detection chain · ATT&CK Enterprise v19.2 detection strategies, analytics, log sources

T1190 Exploit Public-Facing Application exploitation technique

• DET0080 Exploit Public-Facing Application – multi-signal correlation (request → error → post-exploit process/egress)
  AN0219 Windows

  Adversary sends crafted HTTP/S (or other service) input to an Internet-facing app (IIS/ASP.NET, API, device portal). Chain: (1) abnormal request patterns to public endpoint → (2) elevated 4xx/5xx or unusual methods/paths → (3) server process (w3wp.exe/other service) spawns shell/LOLbins or loads non-standard modules → (4) optional outbound callback from the host/container.

  ApplicationLog:IIS IIS W3C logs in C:\inetpub\logs\LogFiles\W3SVC* (spikes in 5xx, RCE/SQLi/path traversal/JNDI patterns) → DC0038 Application Log Content

  WinEventLog:Sysmon EventCode=1 → DC0032 Process Creation

  WinEventLog:Sysmon EventCode=7 → DC0016 Module Load

  WinEventLog:Sysmon EventCode=3, 22 → DC0082 Network Connection Creation

  Tunable: PublicVIPs SuspiciousPatterns ErrorRateThreshold TimeWindow AllowedChildList
  AN0220 Linux

  Adversary exploits Apache/Nginx/app servers. Chain: (1) suspicious requests in access logs → (2) spike of 5xx or WAF blocks → (3) web server or interpreter (apache2/nginx/php-fpm/node/python) spawns /bin/sh, curl, wget, socat, or writes webshell → (4) outbound callback.

  ApplicationLog:WebServer /var/log/httpd/access_log, /var/log/apache2/access.log, /var/log/nginx/access.log with exploit indicators and burst errors → DC0038 Application Log Content

  auditd:SYSCALL execve → DC0032 Process Creation

  NSM:Flow HTTP payloads with SQLi/LFI/JNDI/deserialization indicators → DC0085 Network Traffic Content

  Tunable: WebProcList ChildToolList BurstThreshold TimeWindow
  AN0221 macOS

  Adversary targets macOS-hosted public services (e.g., nginx, node). Chain: suspicious inbound request → service crash/5xx → service spawns shell or writes file → new outbound connection.

  macos:unifiedlog App/web server logs ingested via unified logging or filebeat (nginx/apache/node). → DC0038 Application Log Content

  macos:unifiedlog exec events where web process starts a shell/tooling → DC0032 Process Creation

  NSM:Flow outbound egress from web host after suspicious request → DC0085 Network Traffic Content

  Tunable: ServiceList TimeWindow
  AN0222 Containers

  Adversary exploits containerized app via ingress or service. Chain: (1) suspicious request in ingress/app logs → (2) container process spawns a shell/exec/sidecar (kubectl exec/docker exec) → (3) egress to Internet or metadata service (169.254.169.254).

  ApplicationLog:Ingress Kubernetes NGINX/Envoy ingress controller logs with anomalous payloads and 5xx spikes → DC0038 Application Log Content

  docker:events Docker/Kubernetes audit of exec/attach (kubectl exec) or unexpected child processes inside container → DC0032 Process Creation

  NSM:Flow Requests towards cloud metadata or command & control from pod IPs → DC0085 Network Traffic Content

  Tunable: IngressNamespaces MetadataEndpoints TimeWindow
  AN0223 IaaS

  Adversary targets cloud-hosted public endpoints. Chain: (1) ALB/ELB/Cloud LB logs show exploit-like inputs or error spikes → (2) workload spawns shell or reaches metadata API → (3) egress to new external hosts.

  ALB:HTTPLogs AWS ALB/ELB/GCP/Azure Application Gateway HTTP logs with unusual methods, long URIs, serialized payloads, 4xx/5xx bursts → DC0085 Network Traffic Content

  AWS:VPCFlowLogs VPC/NSG flow logs for pod/instance egress to Internet or metadata → DC0078 Network Traffic Flow

  Tunable: LBProjects ErrorBurst
  AN0224 ESXi

  Adversary exploits exposed OpenSLP on ESXi or vCenter public endpoints. Chain: inbound request pattern to mgmt service → hostd/vpxd error/crash/restart → unexpected process behavior or datastore access → outbound callback.

  esxi:hostd /var/log/hostd.log anomalies (faults, crashes, restarts) around inbound connections → DC0038 Application Log Content

  NSM:Flow Connections to TCP 427 (SLP) or vCenter web services from untrusted sources → DC0085 Network Traffic Content

  Tunable: MgmtCIDR TimeWindow
  AN0225 Network Devices

  Adversary exploits public admin services on routers/firewalls/switches. Chain: anomalous HTTP/SNMP/SmartInstall inputs → device syslog errors/restarts → config changes/CLI spawn → egress to attacker C2.

  networkdevice:controlplane Syslog from edge devices with HTTP 500s on mgmt portal, SmartInstall events, unexpected CLI commands → DC0038 Application Log Content

  NSM:Flow NetFlow/sFlow for odd egress to Internet from mgmt plane → DC0085 Network Traffic Content

  Tunable: MgmtPorts TrustedAdmins

Sigma rules tagged attack.t1190 (149)

All 149 rules on the technique page →

T1486 Data Encrypted for Impact secondary impact

• DET0215 Detection of Multi-Platform File Encryption for Impact
  AN0602 Windows

  High-frequency file write operations using uncommon extensions, followed by ransom note creation, registry tampering, or shadow copy deletion. Often uses CLI tools like vssadmin, wbadmin, cipher, or PowerShell.

  WinEventLog:Sysmon EventCode=1 → DC0032 Process Creation

  WinEventLog:Sysmon EventCode=11 → DC0039 File Creation

  WinEventLog:Sysmon EventCode=2 → DC0061 File Modification

  Tunable: FileExtension TargetFolder TimeWindow CommandLine
  AN0603 Linux

  Encryption via custom or open-source tools (e.g., openssl, gpg, aescrypt) recursively targeting user or system directories. Also includes overwrite of existing data and ransom note drops.

  auditd:SYSCALL openat, write, rename, unlink → DC0061 File Modification

  auditd:SYSCALL execve → DC0032 Process Creation

  Tunable: FilenamePattern SyscallBurstRate DirectoryTargeted
  AN0604 macOS

  Userland or kernel-level ransomware encrypting user files (Documents, Desktop) using srm, gpg, or compiled payloads. Often correlated with ransom note creation in multiple directories.

  macos:unifiedlog file encrypted|new file with .encrypted extension|disk write burst → DC0061 File Modification

  macos:unifiedlog exec srm|exec openssl|exec gpg → DC0032 Process Creation

  Tunable: ExtensionPattern VolumeTargeted
  AN0605 ESXi

  Ransomware encrypts .vmdk, .vmx, .log, or VM config files in VMFS datastores. May rename to .locked or delete/overwrite with encrypted versions. Often correlates with shell commands run through dcui, SSH, or vSphere.

  esxi:vmkernel rename .vmdk to .*.locked|datastore write spike → DC0061 File Modification

  esxi:shell openssl|tar|dd → DC0064 Command Execution

  Tunable: FileType UserContext
  AN0606 IaaS

  Encryption of cloud storage objects (e.g., S3 buckets) via Server-Side Encryption (SSE-C) or by replacing objects with encrypted variants. May include API patterns like PutObject with SSE-C headers.

  AWS:CloudTrail PutObject (with SSE-C), UploadPart (SSE-C) → DC0023 Cloud Storage Modification

  Tunable: SSEHeader AffectedBucket UserAgent

Sigma rules tagged attack.t1486 (16)

All 16 rules on the technique page →

T1496 Resource Hijacking secondary impact

• DET0267 Resource Hijacking Detection Strategy
  AN0741 Windows

  Persistent high CPU utilization combined with suspicious command-line execution (e.g., mining tools or obfuscated scripts) and outbound connections to mining/proxy networks.

  WinEventLog:Sysmon EventCode=1 → DC0032 Process Creation

  Windows:perfmon High sustained CPU usage by a single process → DC0018 Host Status

  WinEventLog:Sysmon EventCode=3, 22 → DC0082 Network Connection Creation

  Tunable: TimeWindow DestinationIPList ExecutableNamePatterns
  AN0742 Linux

  Abnormal CPU/memory usage by unauthorized processes with outbound connections to known mining pools or using cron jobs/scripts to maintain persistence.

  auditd:SYSCALL execve → DC0032 Process Creation

  linux:procfs Sustained high /proc/[pid]/stat usage → DC0018 Host Status

  NSM:Flow Outbound traffic to mining pools or proxies → DC0078 Network Traffic Flow

  Tunable: ProcessPath CPUThreshold KnownMiningDomains
  AN0743 macOS

  Background launch agents/daemons with high CPU use and network access to external mining services.

  macos:unifiedlog launchctl activity and process creation → DC0032 Process Creation

  macos:unifiedlog Persistent outbound traffic to mining domains → DC0085 Network Traffic Content

  Tunable: launchdLabel TrafficVolumeThreshold
  AN0744 IaaS

  Sudden spikes in cloud VM CPU usage with outbound traffic to mining pools and unauthorized instance creation.

  AWS:CloudTrail RunInstances → DC0080 Instance Start

  AWS:CloudWatch Sustained EC2 CPU usage above normal baseline → DC0018 Host Status

  AWS:VPCFlowLogs Outbound flow logs to known mining pools → DC0078 Network Traffic Flow

  Tunable: CPUUtilizationThreshold UnusualRegionList
  AN0745 Containers

  High CPU usage by unauthorized containers running mining binaries or public proxy tools.

  containerd:events New container with suspicious image name or high resource usage → DC0032 Process Creation

  prometheus:metrics Container CPU/Memory usage exceeding threshold → DC0018 Host Status

  container:cni Outbound network traffic to mining proxies → DC0078 Network Traffic Flow

  Tunable: ImageName CPUQuotaThreshold
  AN0746 SaaS

  Abuse of cloud messaging platforms to send mass spam or consume quota-based resources.

  m365:unified SendMessage → DC0069 Cloud Service Modification

  saas:application High-volume API calls or traffic via messaging or webhook service → DC0038 Application Log Content

  Tunable: MessageRateThreshold APIKeyList

Sigma rules tagged attack.t1496 (13)

T1505.003 Web Shell secondary impact

• DET0394 Web Shell Detection via Server Behavior and File Execution Chains
  AN1108 Windows

  Unexpected file creation in web directories followed by web server processes (e.g., w3wp.exe) spawning command shells or script interpreters (e.g., cmd.exe, powershell.exe)

  WinEventLog:Sysmon EventCode=11 → DC0039 File Creation

  WinEventLog:Sysmon EventCode=1 → DC0032 Process Creation

  WinEventLog:Security EventCode=4624, 4648 → DC0067 Logon Session Creation

  NSM:Flow Inbound HTTP POST with suspicious payload size or user-agent → DC0085 Network Traffic Content

  Tunable: WebRootPath ParentProcess
  AN1109 Linux

  File creation of unauthorized script (e.g., .php, .sh) in /var/www/html followed by execution of unexpected system utilities (e.g., curl, bash, nc) by apache/nginx

  auditd:SYSCALL new file created in /var/www/html, /srv/http, or similar web root → DC0039 File Creation

  auditd:SYSCALL apache2 or nginx spawning sh, bash, or python interpreter → DC0032 Process Creation

  NSM:Flow POST requests to .php, .jsp, .aspx files with high entropy body → DC0085 Network Traffic Content

  Tunable: WebRootPath PayloadEntropyThreshold TimeWindow
  AN1110 macOS

  Web servers (e.g., httpd) spawning abnormal processes post file upload into /Library/WebServer/Documents or /usr/local/var/www

  macos:unifiedlog httpd spawning bash, zsh, python, or osascript → DC0032 Process Creation

  auditd:SYSCALL file write operations in /Library/WebServer/Documents → DC0061 File Modification

  Tunable: InterpreterName ExecutionParent

Sigma rules tagged attack.t1505.003 (35)

All 35 rules on the technique page →

T1608.001 Upload Malware secondary impact

• DET0824 Detection of Upload Malware
  AN1956 PRE

  If infrastructure or patterns in malware have been previously identified, internet scanning may uncover when an adversary has staged malware to make it accessible for targeting. Much of this activity will take place outside the visibility of the target organization, making detection of this behavior difficult. Detection efforts may be focused on post-compromise phases of the adversary lifecycle, such as User Execution or Ingress Tool Transfer .

  Internet Scan None → DC0104 Response Content

Sigma rules tagged attack.t1608.001 (0)

None. MITRE's strategy above is the only public detection guidance for this technique.

Sigma rules tagged with this CVE directly

2 rules carry cve.2021-44228.