ATT&CK ReferencesMicrosoft Log4j Vulnerability Exploitation December 2021

Microsoft Log4j Vulnerability Exploitation December 2021

Microsoft Threat Intelligence. (2021, December 11). Guidance for preventing, detecting, and hunting for exploitation of the Log4j 2 vulnerability. Retrieved December 7, 2023.

Open the source

Techniques0

Not cited by any technique.

Groups0

None recorded.

Software0

None recorded.

Campaigns0

None recorded.

Procedure examples3

Technique	Used by	Procedure example
T1190 Exploit Public-Facing Application	GroupCinnamon Tempest	Cinnamon Tempest has exploited multiple unpatched vulnerabilities for initial access including vulnerabilities in Microsoft Exchange, Manage Engine AdSelfService Plus, Confluence, and Log4j. Microsoft Log4j Vulnerability Exploitation December 2021 Microsoft Ransomware as a Service SecureWorks BRONZE STARLIGHT Ransomware Operations June 2022 Sygnia Emperor Dragonfly October 2022
T1190 Exploit Public-Facing Application	GroupMagic Hound	Magic Hound has exploited the Log4j utility (CVE-2021-44228), on-premises MS Exchange servers via "ProxyShell" (CVE-2021-34473, CVE-2021-34523, CVE-2021-31207), and Fortios SSL VPNs (CVE-2018-13379). Check Point APT35 CharmPower January 2022 Cybereason PowerLess February 2022 DFIR Phosphorus November 2021 DFIR Report APT35 ProxyShell March 2022 Microsoft Iranian Threat Actor Trends November 2021 Microsoft Log4j Vulnerability Exploitation December 2021
T1190 Exploit Public-Facing Application	GroupHAFNIUM	HAFNIUM has exploited multiple vulnerabilities to compromise edge devices and on-premises versions of Microsoft Exchange Server. FireEye Exchange Zero Days March 2021 Microsoft HAFNIUM March 2020 Microsoft Log4j Vulnerability Exploitation December 2021 Microsoft Silk Typhoon MAR 2025 Tarrask scheduled task Volexity Exchange Marauder March 2021

Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.