CCFH-202B: CrowdStrike Certified Falcon Hunter

By CrowdStrike · Question Mode

QuestionQ37

VerifiedDetection Analysis

You are investigating a compromise on a Linux host. You suspect the host is running an older Apache version and that the Log4j (CVE-2021-44228) vulnerability is being exploited through JNDI lookups.

Which CQL query could you use to determine whether Log4j is the root cause of the compromise?

Explanation

Log4Shell exploitation commonly injects JNDI lookup strings, including obfuscated forms, into application-controlled content. Filtering ScriptControlDetectInfo events for ScriptContent that matches the JNDI pattern directly hunts for this exploitation indicator, providing evidence that the compromise involved Log4j’s JNDI lookup vulnerability.

Community Discussion

No comments yet. Be the first to start the discussion!