alert tcp any any -> any any (msg:"ATTACK [PTsecurity] log4j RCE aka Log4Shell TCP attempt (CVE-2021-44228)"; flow:established; content:"${"; content:"j"; distance:0; nocase; content:"n"; distance:0; nocase; content:"d"; distance:0; nocase; content:"i"; distance:0; nocase; content:":"; distance:0; nocase; pcre:"/\${(?:\${date:}|\${date:\'|\${upper:|\${lower:|\${env:[^:]*:-\}?|\${.*?:-)*}*j\'*}*(?:\${date:}|\${date:\'|\${upper:|\${lower:|\${env:[^:]*:-\}?|\${.*?:-)*}*n\'*}*(?:\${date:}|\${date:\'|\${upper:|\${lower:|\${env:[^:]*:-\}?|\${.*?:-)*}*d\'*}*(?:\${date:}|\${date:\'|\${upper:|\${lower:|\${env:[^:]*:-\}?|\${.*?:-)*}*i\'*}*(?:\${date:}|\${date:\'|\${upper:|\${lower:|\${env:[^:]*:-\}?|\${.*?:-)*}*:\'*}*(?:(?:\${date:}|\${date:\'|\${upper:|\${lower:|\${env:[^:]*:-\}?|\${.*?:-)*}*l\'*}*(?:\${date:}|\${date:\'|\${upper:|\${lower:|\${env:[^:]*:-\}?|\${.*?:-)*}*d\'*}*(?:\${date:}|\${date:\'|\${upper:|\${lower:|\${env:[^:]*:-\}?|\${.*?:-)*}*a\'*}*(?:\${date:}|\${date:\'|\${upper:|\${lower:|\${env:[^:]*:-\}?|\${.*?:-)*}*p\'*}*|(?:\${date:}|\${date:\'|\${upper:|\${lower:|\${env:[^:]*:-\}?|\${.*?:-)*}*d\'*}*(?:\${date:}|\${date:\'|\${upper:|\${lower:|\${env:[^:]*:-\}?|\${.*?:-)*}*n\'*}*(?:\${date:}|\${date:\'|\${upper:|\${lower:|\${env:[^:]*:-\}?|\${.*?:-)*}*s\'*}*|(?:\${date:}|\${date:\'|\${upper:|\${lower:|\${env:[^:]*:-\}?|\${.*?:-)*}*r\'*}*(?:\${date:}|\${date:\'|\${upper:|\${lower:|\${env:[^:]*:-\}?|\${.*?:-)*}*m\'*}*(?:\${date:}|\${date:\'|\${upper:|\${lower:|\${env:[^:]*:-\}?|\${.*?:-)*}*i\'*}*|(?:\${date:}|\${date:\'|\${upper:|\${lower:|\${env:[^:]*:-\}?|\${.*?:-)*}*i\'*}*(?:\${date:}|\${date:\'|\${upper:|\${lower:|\${env:[^:]*:-\}?|\${.*?:-)*}*i\'*}*(?:\${date:}|\${date:\'|\${upper:|\${lower:|\${env:[^:]*:-\}?|\${.*?:-)*}*o\'*}*(?:\${date:}|\${date:\'|\${upper:|\${lower:|\${env:[^:]*:-\}?|\${.*?:-)*}*p\'*}*)/i"; reference:cve, 2021-44228; reference:url, www.lunasec.io/docs/blog/log4j-zero-day; reference:url, rules.ptsecurity.com; classtype:attempted-admin; sid:10006902; rev:3;)