search

corelight / cve-2021-44228

Log4j Exploit Detection Logic for Zeek
BSD 3-Clause "New" or "Revised" License
18 stars 8 forks source link

log4j.log field naming considerations #38

Open dwdixon opened 2 years ago

dwdixon commented 2 years ago

This is probably not a huge deal, however, I just wanted to comment that the field names target_host and target_port in the log4j.log at first blush seem a bit misleading/confusing, but maybe I'm just being a bit pedantic? : ) My thoughts are essentially that these fields would perhaps be more aptly named something like payload_host/payload_port or callback_host/callback_port? Using the term target_ is a bit misleading in that the target is IMHO more intuitively the systems on our local networks being targeted for exploitation rather than the attacker callback/payload host and port serving up the next stage of the exploit chain which is what the log4j.log is parsing out and tracking as far as I understand it.

I'm not sure if it's maybe slightly counterproductive to change these field names now as it may cause some minor headaches for people already using the fields with SIEM queries but it might be worth it in the long run...anyhow...something to consider, thanks for the amazing work on this package, the recent enhancements are really awesome and super valuable! If this isn't worthwhile feel free to close this out, you won't hurt my feelings : )

ynadji commented 2 years ago

Totally agree with you @dwdixon and the minor headaches you mentioned are largely why I haven't changed to fields to more sensible names yet. I'm definitely a bit disappointed in past @ynadji but he was tired at the time I think ;). I'm glad the package has been useful for you! I'll ask around in the Zeek Slack to see if there's an idiomatic way to do this so we can have better names while minimizing problems for other folks.