topic Log4j batch file execution in Cortex XDR Discussions

Log4j batch file execution

AsifSid — Tue, 04 Jan 2022 09:42:09 GMT

Hi All.

From the Palo alto advisory as per below, we have to run a batch file via our SCCM tool. But I need to understand what version of log4j we are using on our Cortex. How can we find out , Please help

To ensure you disable message lookup, follow the following steps:

Disable Log4j message lookups environment variable

XDR Pro customers - From the Action Center, select Actions > Run Endpoint Script and in the SCRIPT field select execute_command. Specify the Commands_lists(list) field as setx LOG4J_FORMAT_MSG_NO_LOOKUPS true /M. In the next screen, you will have an option to select the target machines.
XDR Prevent customers - Execute the following batch script with administrative privileges on your machines: https://storage.cloud.google.com/panwxdr-staticfiles/apply_log4shell_workaround.bat

Re: Log4j batch file execution

bbarmanroy — Wed, 05 Jan 2022 03:15:05 GMT

Hi @AsifSid , You're the best person to know what is running in your environments. You can run a XQL query to partially identify if the vulnerable JAR's are being loaded or if JNDI calls are being made in your estate.

This should get you started on the right track: https://www.paloaltonetworks.com/blog/security-operations/hunting-for-log4j-cve-2021-44228-log4shell-exploit-activity/.

Re: Log4j batch file execution

Victor1 — Wed, 05 Jan 2022 18:41:28 GMT

The link asks us to log into a google account. We're a Microsoft shop, is there anywhere else we can download the file from?

Re: Log4j batch file execution

bbarmanroy — Fri, 07 Jan 2022 02:34:57 GMT

@Victor1 It is a publicly available link. Are you able to view the link from your mobile or another device?