Log4j batch file execution

[AsifSid]

Hi All.

From the Palo alto advisory as per below, we have to run a batch file via our SCCM tool. But I need to understand what version of log4j we are using on our Cortex. How can we find out , Please help

To ensure you disable message lookup, follow the following steps:

1. Disable Log4j message lookups environment variable
• XDR Pro customers - From the Action Center, select Actions > Run Endpoint Script and in the SCRIPT field select execute_command. Specify the Commands_lists(list) field as setx LOG4J_FORMAT_MSG_NO_LOOKUPS true /M. In the next screen, you will have an option to select the target machines.
• XDR Prevent customers - Execute the following batch script with administrative privileges on your machines: https://storage.cloud.google.com/panwxdr-staticfiles/apply_log4shell_workaround.bat

[bbarmanroy]

Hi @AsifSid , You're the best person to know what is running in your environments. You can run a XQL query to partially identify if the vulnerable JAR's are being loaded or if JNDI calls are being made in your estate.

This should get you started on the right track: https://www.paloaltonetworks.com/blog/security-operations/hunting-for-log4j-cve-2021-44228-log4shell....

[Victor1]

The link asks us to log into a google account. We're a Microsoft shop, is there anywhere else we can download the file from?

[bbarmanroy]

@Victor1 It is a publicly available link. Are you able to view the link from your mobile or another device?