GitHub - cube0x0/noPac: CVE-2021-42287/CVE-2021-42278 Scanner & Exploiter.
https://github.com/cube0x0/noPac
eXploit – CVE-2021-42287/CVE-2021-42278 Weaponisation
https://exploit.ph/cve-2021-42287-cve-2021-42278-weaponisation.html
Volkan Yazıcı on Twitter: "Log4j maintainers have been working sleeplessly on mitigation measures; fixes, docs, CVE, replies to inquiries, etc. Yet nothing is stopping people to bash us, for work we aren't paid for, for a feature we all dislike yet needed to keep due to backward compatibility concerns." / Twitter
https://twitter.com/yazicivo/status/1469349956880408583
Microsoft’s Response to CVE-2021-44228 Apache Log4j 2 | MSRC Blog | Microsoft Security Response Center
https://msrc-blog.microsoft.com/2021/12/11/microsofts-response-to-cve-2021-44228-apache-log4j2/
GitHub - WazeHell/sam-the-admin: Exploiting CVE-2021-42278 and CVE-2021-42287 to impersonate DA from standard domain user
https://github.com/WazeHell/sam-the-admin
Exploit samAccountName spoofing with Kerberos - Cloudbrothers
https://cloudbrothers.info/en/exploit-kerberos-samaccountname-spoofing/
Log4j 0day being exploited : blueteamsec
https://www.reddit.com/r/blueteamsec/comments/rd38z9/log4j_0day_being_exploited/
Zero-Day Exploit Targeting Popular Java Library Log4j
https://www.govcert.ch/blog/zero-day-exploit-targeting-popular-java-library-log4j/
Tweet / Twitter
https://twitter.com/theasf/status/1400875147163279374
Crash Override on Twitter: "I always used to joke that if there was an RCE in Log4J all hell might break lose. Yikes ! https://t.co/h59jGUFVyL" / Twitter
https://twitter.com/curphey/status/854174411863212033
sAMAccountName spoofing - The Hacker Recipes
https://www.thehacker.recipes/ad/movement/kerberos/samaccountname-spoofing
Splunk Security Advisory for Apache Log4j (CVE-2021-44228, CVE-2021-45046 and others) | Splunk
https://www.splunk.com/en_us/blog/bulletins/splunk-security-advisory-for-apache-log4j-cve-2021-44228.html
GitHub - curated-intel/Log4Shell-IOCs: A collection of intelligence about Log4Shell and its exploitation activity.
https://github.com/curated-intel/Log4Shell-IOCs
BlueTeam CheatSheet * Log4Shell* | Last updated: 2021-12-20 2238 UTC · GitHub
https://gist.github.com/SwitHak/b66db3a06c2955a9cb71a8718970c592
Statement from CISA Director Easterly on “Log4j” Vulnerability | CISA
https://www.cisa.gov/news/2021/12/11/statement-cisa-director-easterly-log4j-vulnerability
Zero-Day Exploit Targeting Popular Java Library Log4j
https://www.govcert.admin.ch/blog/zero-day-exploit-targeting-popular-java-library-log4j/
Invoke-noPac.ps1 · GitHub
https://gist.github.com/S3cur3Th1sSh1t/0ed2fb0b5ae485b68cbc50e89581baa6
GitHub - timb-machine/log4j: Detection rules to look for Log4J usage and exploitation
https://github.com/timb-machine/log4j/
Canarytokens
https://canarytokens.org
Environment variables to configure the AWS CLI - AWS Command Line Interface
https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-envvars.html
CVE-2021-44228 - Log4j - MINECRAFT VULNERABLE! (and SO MUCH MORE) - YouTube
https://www.youtube.com/watch?v=7qoPDq41xhQ
Microsoft Security Intelligence on Twitter: "Microsoft is tracking threats taking advantage of the CVE-2021-44228 remote code execution (RCE) vulnerability in Apache Log4j 2 ("Log4Shell"). Get technical info and guidance for preventing, detecting, and hunting for related attacks: https://t.co/vOB7R1LXlj" / Twitter
https://twitter.com/msftsecintel/status/1469904367281229824
The Cyber Startup Observatory - The Global Cyber Innovation Network
https://cyberstartupobservatory.com
GitHub - Neo23x0/log4shell-detector: Detector for Log4Shell exploitation attempts
https://github.com/Neo23x0/log4shell-detector
Active Directory Security Beginner Bootcamp [Jan 2022]: Earn CRTP | Pentester Academy
https://bit.ly/3dtbhVG![Active Directory Security Beginner Bootcamp [Jan 2022]: Earn CRTP | Pentester Academy](/image/screenshot/ad73f027611628b888f18b3d9471618b.webp)
Guidance for preventing, detecting, and hunting for exploitation of the Log4j 2 vulnerability - Microsoft Security Blog
https://www.microsoft.com/security/blog/2021/12/11/guidance-for-preventing-detecting-and-hunting-for-cve-2021-44228-log4j-2-exploitation/