Corelight Bright Ideas Blog

Java

Detecting Log4j exploits via Zeek when Java downloads Java

By Corelight Labs Team – December 18, 2021

We have published an initial blog on the Log4j exploit and a followup blog with a second detection method for detecting the first stage of exploits occurring over LDAP. Today, we will discuss a third detection method, this one focused on the... Read more »

Detecting Log4j via Zeek & LDAP traffic

By Corelight Labs Team – December 16, 2021

We recently discussed some methods for detecting the Log4j exploit, and we’ve now developed another method that everyone running Zeek® or a Corelight sensor can use. Our new approach is based on the rarity of legitimate downloads of Java via LDAP.... Read more »

Corelight Bright Ideas Blog

Java

Detecting Log4j exploits via Zeek when Java downloads Java

Detecting Log4j via Zeek & LDAP traffic

Recent Posts

Sign up for our newsletter

Locations

1 (888) 547-9497

We're hiring!