You can use these commands and rules to search for exploitation attempts against log4j RCE vulnerability CVE-2021-44228
This command searches for exploitation attempts in uncompressed files in folder /var/log and all sub folders
sudo egrep -I -i -r '\$(\{|%7B)jndi:(ldap[s]?|rmi|dns|nis|iiop|corba|nds|http):/[^\n]+' /var/log| # For recent versions of Ubuntu: | |
| - https://www.pugetsystems.com/labs/hpc/ubuntu-22-04-server-autoinstall-iso/ | |
| # Docs: | |
| - https://wiki.ubuntu.com/FoundationsTeam/AutomatedServerInstalls | |
| - https://wiki.ubuntu.com/FoundationsTeam/AutomatedServerInstalls/ConfigReference | |
| - https://cloudinit.readthedocs.io/en/latest/topics/datasources/nocloud.html | |
| - https://discourse.ubuntu.com/t/please-test-autoinstalls-for-20-04/15250/53 | |
| # Download ISO Installer: |
| { | |
| "explorer.openEditors.visible": 0, | |
| "workbench.colorTheme": "Default Light+", | |
| "workbench.iconTheme": "vscode-simpler-icons", | |
| "workbench.sideBar.location": "right", | |
| // 需下載安裝 Fira Code 字型 (安裝 OTF 格式) | |
| // https://github.com/tonsky/FiraCode/releases | |
| // 需下載客製化過的 Microsoft YaHei Mono 字型 |
