Skip to content

Latest commit

 

History

History
26 lines (18 loc) · 1.38 KB

README.md

File metadata and controls

26 lines (18 loc) · 1.38 KB
Raw

Log4Shell IIOP Traffic

Log4Shell attack strings which include iiop:// can result in Internet Interop-Orb-Protocol (IIOP) connection requests. The signatures detailed below attempt to detection this IIOP traffic.

A pcap of non-malicious IIOP traffic can be found on Cloudshark

Details of the protocol can be found via Oracle documentation

Example Traffic

Detection Logic

Network detection for IIOP, which is largely GIOP (General Inter-ORB Protocol) over TCP/IP focuses on alerting of an Outbound request followed by a valid GIOP message from the server.

Outbound Request

sid msg Notes Detection Screenshot
2034730 ET POLICY GIOP/IIOP Request Outbound sets flowbit 2034730

Successful Response

sid msg Notes Detection Screenshot
2034731 ET POLICY Successful GIOP/IIOP Request Outbound depends on 2034730 2034731