## https://sploitus.com/exploit?id=5CEF4882-D1D5-5861-944F-34E8868BF986
## Log4J-CVE-Detect
This repository contains a set of YARA rules for detecting versions of log4j which are
vulnerable to CVE-2021-44228, CVE-2021-45046, and / or CVE-2021-45105 by looking for a
number of features which appear in affected versions.
This tool works recursively on binary files such as Docker images, system packages,
filesystem images, and even installation media. See the "How does it work?" section for
a full list of supported file formats.
* CVE-2021-44228
* Looks for the signature of a `JndiManager` constructor ( STACS is a YARA powered static credential scanner which suports binary file formats,
> analysis of nested archives, composable rulesets and ignore lists, and SARIF
> reporting.
As an example, this tool can analyse a tarball which contains an exported Docker image,
which contains a JAR somewhere on the filesystem which is affected by this
vulnerability.
It can also analyse nested `tar`, `jar`, `war`, `ear`, `zip`, `apk`, `bz2`, `tgz`,
`xz`, `rpm`, `iso`, etc.
### I found a false positive / negative
Please open a Github issue describing the issue, and linking to the affected binary
artifact - where possible.
Pull requests to adjust to the rulesets would also be greatly appreciated!
### Validation
See the `validation/` directory for a set of log files from validation of this ruleset.