Log4j Analysis: What to Do | Cybersecurity Blog | Grey Noise
Summary: A month after the Log4Shell vulnerability (CVE-2021-44228) was announced in early December 2021, GreyNoise still observed a significant volume of Log4j-related traffic, primarily generic JNDI string exploit attempts with known obfuscations. During the first days of the outbreak, a large share of the scanning surge came from benign actors such as security firms, researchers, and academics, and follow-on CVEs (CVE-2021-45046, CVE-2021-45105, CVE-2021-44832) bypassed the initial patch with varied attack vectors.
What's compelling: GreyNoise researchers found at least two attempted Log4j exploits where the malicious string was base64 encoded in an application-specific parameter, slipping past a tag built on JNDI format strings - and any significant volume of unsolicited traffic, even benign, can cause SOC alert fatigue and dangerous distraction during an active attack.