Technical Tip: How to use FortiSIEM to detect activities related to the log4shell vulnerability CVE-2021-44228

This article describes how to use custom Rules and Reports to help detect activity related to the log4j vulnerability CVE-2021-44228.

What is included in Fortinet_FortiSIEM-log4j-Detection-v1.zip?

1) FortiSIEM_log4j_Rules_v2.xml.

These Rules help identify exploit attempts detected by FortiGate's IPS, or Events categorised as Permitted Traffic with the URI or HTTP content (see rules for specific attributes) that match a particular regex pattern.

2) FortiSIEM_log4j_Reports_v2.1.xml.

These Reports can be run on a schedule or on-demand and help identify exploit attempts detected by FortiGate's IPS, or Events categorised as Permitted Traffic with the URI or HTTP content (see rules for specific attributes) that match a particular regex pattern.

For more information about this attack, see the following FortiGuard Outbreak Alert: FortiGuard Outbreak Alert - Log4j2 Vulnerability

Updated: 2021-12-17 - revision 2, changes to the "Log4J Exploit Request Detected By Regex" Rule to increase the scope and reduce false positives.

Updated: 2021-12-20 - no change in content, but revised Report file naming to v2 in line with Solution steps below. The report content remains the same.

Updated: 2021-12-20 - updated Reports to version 2.1. Provides better support for import on some FortiSIEM versions.

All screenshots provided below for illustration purposes are taken from FortiSIEM 6.3.2.

1) Download the Fortinet_FortiSIEM-log4j-Detection-v2.zip file (contains 2 file).

2) Unzip Fortinet_FortiSIEM-log4j-Detection-v2.zip

3) Use FortiSIEM_log4j_Reports_v2.1.xml  as the file to import the Reports
- Navigate to Resource / Reports.
- It is recommended to create a new group under Resource / Reports / Security called 'log4j Exploit Detection' and import reports to this group.
- Select the Import option under More.
- Select FortiSIEM_log4j_Reports_v2.1.xml  and import.

4) Use FortiSIEM_log4j_Rules_v2.xml  as the file to import the Rules
- Navigate to Resource / Rules.
- It is recommended to create a new group under Resource / Rules / Security / Threat Hunting is created called 'log4 Exploit Detection' and import the rules to this group.
- Select the Import.
- Select FortiSIEM_log4j_Rules_v2.xml  and import.
- Filter the rules on log4j and ensure it is enabled.

Imported and enabled Rules

Imported Reports