From e2aa3665afdbd756539b4e5feb5508a5c0467f9d Mon Sep 17 00:00:00 2001
From: Florian Roth <venom14@gmail.com>
Date: Sun, 6 Feb 2022 08:56:54 +0100
Subject: [PATCH] fix: avoid Microsoft Defender detections

We keep the strings as specific as necessary while avoiding Microsoft Defender detections on the rule files
---
 rules/web/web_cve_2021_44228_log4j.yml        |  8 ++---
 rules/web/web_cve_2021_44228_log4j_fields.yml | 30 +++++++++++--------
 2 files changed, 21 insertions(+), 17 deletions(-)

diff --git a/rules/web/web_cve_2021_44228_log4j.yml b/rules/web/web_cve_2021_44228_log4j.yml
index ada6fca78e4..e53a08ec57a 100644
--- a/rules/web/web_cve_2021_44228_log4j.yml
+++ b/rules/web/web_cve_2021_44228_log4j.yml
@@ -4,7 +4,7 @@ status: experimental
 description: Detects exploitation attempt against log4j RCE vulnerability reported as CVE-2021-44228 (Log4Shell)
 author: Florian Roth
 date: 2021/12/10
-modified: 2021/12/13
+modified: 2022/02/06
 references:
     - https://www.lunasec.io/docs/blog/log4j-zero-day/
     - https://news.ycombinator.com/item?id=29504755
@@ -38,9 +38,9 @@ detection:
         - '${${env:BARFOO:-j}'
         - '${::-l}${::-d}${::-a}${::-p}'
         - '${base64:JHtqbmRp'
-        - '${${env:ENV_NAME:-j}ndi${env:ENV_NAME:-:}${env:ENV_NAME:-l}dap${env:ENV_NAME:-:}//'
-        - '${${lower:j}ndi:${lower:l}${lower:d}a${lower:p}://'
-        - '${${upper:j}ndi:${upper:l}${upper:d}a${lower:p}://'
+        - '${${env:ENV_NAME:-j}ndi${env:ENV_NAME:-:}$'
+        - '${${lower:j}ndi:'
+        - '${${upper:j}ndi:'
         - '${${::-j}${::-n}${::-d}${::-i}:'
     condition: keywords
 falsepositives:
diff --git a/rules/web/web_cve_2021_44228_log4j_fields.yml b/rules/web/web_cve_2021_44228_log4j_fields.yml
index bf8db9f4faf..3304fa06eb5 100644
--- a/rules/web/web_cve_2021_44228_log4j_fields.yml
+++ b/rules/web/web_cve_2021_44228_log4j_fields.yml
@@ -4,7 +4,7 @@ status: experimental
 description: Detects exploitation attempt against log4j RCE vulnerability reported as CVE-2021-44228 in different header fields found in web server logs (Log4Shell)
 author: Florian Roth
 date: 2021/12/10
-modified: 2021/12/16
+modified: 2022/02/06
 references:
    - https://www.lunasec.io/docs/blog/log4j-zero-day/
    - https://news.ycombinator.com/item?id=29504755
@@ -35,12 +35,13 @@ detection:
          - '${jndi:nds'
          - '${jndi:corba'
          - '${jndi:iiop'
+         - 'Reference Class Name: foo'
          - '${${env:BARFOO:-j}'
          - '${::-l}${::-d}${::-a}${::-p}'
          - '${base64:JHtqbmRp'
-         - '${${env:ENV_NAME:-j}ndi${env:ENV_NAME:-:}${env:ENV_NAME:-l}dap${env:ENV_NAME:-:}//'
-         - '${${lower:j}ndi:${lower:l}${lower:d}a${lower:p}://'
-         - '${${upper:j}ndi:${upper:l}${upper:d}a${lower:p}://'
+         - '${${env:ENV_NAME:-j}ndi${env:ENV_NAME:-:}$'
+         - '${${lower:j}ndi:'
+         - '${${upper:j}ndi:'
          - '${${::-j}${::-n}${::-d}${::-i}:'
    selection2:         
       user-agent|contains:
@@ -59,12 +60,13 @@ detection:
          - '${jndi:nds'
          - '${jndi:corba'
          - '${jndi:iiop'
+         - 'Reference Class Name: foo'
          - '${${env:BARFOO:-j}'
          - '${::-l}${::-d}${::-a}${::-p}'
          - '${base64:JHtqbmRp'
-         - '${${env:ENV_NAME:-j}ndi${env:ENV_NAME:-:}${env:ENV_NAME:-l}dap${env:ENV_NAME:-:}//'
-         - '${${lower:j}ndi:${lower:l}${lower:d}a${lower:p}://'
-         - '${${upper:j}ndi:${upper:l}${upper:d}a${lower:p}://'
+         - '${${env:ENV_NAME:-j}ndi${env:ENV_NAME:-:}$'
+         - '${${lower:j}ndi:'
+         - '${${upper:j}ndi:'
          - '${${::-j}${::-n}${::-d}${::-i}:'
    selection3:
       cs-uri|contains:
@@ -83,12 +85,13 @@ detection:
          - '${jndi:nds'
          - '${jndi:corba'
          - '${jndi:iiop'
+         - 'Reference Class Name: foo'
          - '${${env:BARFOO:-j}'
          - '${::-l}${::-d}${::-a}${::-p}'
          - '${base64:JHtqbmRp'
-         - '${${env:ENV_NAME:-j}ndi${env:ENV_NAME:-:}${env:ENV_NAME:-l}dap${env:ENV_NAME:-:}//'
-         - '${${lower:j}ndi:${lower:l}${lower:d}a${lower:p}://'
-         - '${${upper:j}ndi:${upper:l}${upper:d}a${lower:p}://'
+         - '${${env:ENV_NAME:-j}ndi${env:ENV_NAME:-:}$'
+         - '${${lower:j}ndi:'
+         - '${${upper:j}ndi:'
          - '${${::-j}${::-n}${::-d}${::-i}:'
    selection4:
       cs-referer|contains:
@@ -107,12 +110,13 @@ detection:
          - '${jndi:nds'
          - '${jndi:corba'
          - '${jndi:iiop'
+         - 'Reference Class Name: foo'
          - '${${env:BARFOO:-j}'
          - '${::-l}${::-d}${::-a}${::-p}'
          - '${base64:JHtqbmRp'
-         - '${${env:ENV_NAME:-j}ndi${env:ENV_NAME:-:}${env:ENV_NAME:-l}dap${env:ENV_NAME:-:}//'
-         - '${${lower:j}ndi:${lower:l}${lower:d}a${lower:p}://'
-         - '${${upper:j}ndi:${upper:l}${upper:d}a${lower:p}://'
+         - '${${env:ENV_NAME:-j}ndi${env:ENV_NAME:-:}$'
+         - '${${lower:j}ndi:'
+         - '${${upper:j}ndi:'
          - '${${::-j}${::-n}${::-d}${::-i}:'
    condition: 1 of selection*
 falsepositives: