CVE-2021-44228

Description

This detection identifies exploitation attempts targeting CVE-2021-44228, which has a CRITICAL severity rating. Apache Log4j2 2.0-beta9 through 2.15.0 does not protect JNDI features used in configuration, log messages, and parameters against cyberattacker controlled LDAP and other JNDI endpoints. A cyberattacker who can control log messages or their parameters can execute arbitrary code loaded from LDAP servers when the configuration enables message lookup substitution, an issue known as Log4Shell. Later releases turned the behavior off and then removed it entirely, and the vulnerability affects only log4j-core.

Stats

First seen: July 2022
Last seen: October 2026

CVEs

CVE-2021-44228

Alert name variants

Alert Name	Engine
Binary.Exploit.CVE-2021-44228	ATP Sandbox Adv. Heuristics
ByteCode-JAVA.Exploit.CVE-2021-44228	ATP Sandbox Adv. Heuristics
Document-HTML.Exploit.CVE-2021-44228	ATP Sandbox Adv. Heuristics
Linux.Exploit.CVE-2021-44228	ATP Sandbox Adv. Heuristics
Package.Exploit.CVE-2021-44228	ATP Sandbox Adv. Heuristics
Win32.Exploit.CVE-2021-44228	ATP Sandbox Adv. Heuristics
Win64.Exploit.CVE-2021-44228	ATP Sandbox Adv. Heuristics

Related IPS Signatures

Signature Name	Engine
ET HUNTING Possible Apache log4j RCE Attempt - Any Protocol (lower TCP Bypass) (CVE-2021-44228)	IPS-NPA
INDICATOR-COMPROMISE JNDI LDAP searchResEntry dynamic code download attempt	IPS-CFW
MALWARE-OTHER Apache log4j RCE Attempt outbound CVE-2021-44228	IPS-CFW
MALWARE-OTHER Serialized Java Object returned via LDAPv3 Response	IPS-CFW
PROTOCOL-LDAP Apache log4j RCE Attempt outbound CVE-2021-44228	IPS-CFW
SERVER-OTHER Apache Log4j logging remote code execution attempt	IPS-NPA
SERVER-OTHER VMWare vSphere log4shell exploit attempt	IPS-NPA
SERVER-WEBAPP Apache Log4j logging remote code execution attempt	IPS-NPA