Log4J - Where are malicious payloads downloaded to?
Most of the write-ups that I'm finding state that Log4J calls out to a malicious host to download a payload. Are these pulled down into the "log" directory that Log4J is writing to, or is there some other location they would go to?
Consideration is whether we should be looking at EDR whitelists and stripping exclusions for Log4J. I don't think that will help in this case since Log4J isn't doing anything malicious and I don't think the payloads would download to the directory that Log4J resides in.
Posted Dec 16, 2021, 3:20 PM UTC
31
The initial exploit downloads the payload into memory, where it's executed within the current process. What it does, and what files it may download and to where, depend entirely upon the payload itself and not some property of Java nor even the vulnerability.