- User-agent
- 검색 필드
- 사용자 이름
- ...

Get-PSDrive -PSProvider FileSystem | foreach {(gci ($_.Root) -rec -force -include *.jar -ea 0 | foreach {select-string "JndiLookup.class" $_} | select -exp Path)}

Get-CimInstance win32_volume | Where-Object { $_.DriveType -eq 3 -and $_.DriveLetter -ne $null} | ForEach-Object {(gci ($_.DriveLetter+"\") -rec -force -include *.jar -ea 0 | foreach {select-string "JndiLookup.class" $_} | select -exp Path)}

Get-WinEvent -ListLog * |
  foreach { get-winevent @{logname=$_.logname; } -ea 0 } |
  where message -match 'jndi'

#!/bin/bash
find / -name '*log4j*.jar' -print0 2>/dev/null -print0 | while read -d $'\0' log4j; do
        echo -en "${log4j}: "$(unzip -p "${log4j}" | strings | grep -Po '^Implementation-Version:\s+([0-9\.]+)' | awk '{ print $NF }')"\n"
done
exit 0

[Environment]:https://raw.githubusercontent.com/helsecert/cve-2021-44228/HEAD/:SetEnvironmentVariable(%22LOG4J_FORMAT_MSG_NO_LOOKUPS%22,%22true%22,%22Machine%22)

"‐Dlog4j2.formatMsgNoLookups=True"

JAVA_OPTS="-Dlog4j2.formatMsgNoLookups=true" teku --network mainnet

JAVA_OPTS="-Dlog4j2.formatMsgNoLookups=true -Xmx4g" teku

Environment='JAVA_OPTS="-Dlog4j2.formatMsgNoLookups=true"'

Environment='JAVA_OPTS="-Dlog4j2.formatMsgNoLookups=true" "-Xmx4g'

[Reflection.Assembly]:https://raw.githubusercontent.com/helsecert/cve-2021-44228/HEAD/:LoadWithPartialName(%27System.IO.Compression%27)
$JarFilLokasjon = 'C:\temp\log4j-core-2.13.0-test.jar'
$Filnavn   = 'JndiLookup.class' #이 파일이 삭제됩니다!

$Stream = New-Object IO.FileStream($JarFilLokasjon, [IO.FileMode]::Open)
$ZipMode   = [IO.Compression.ZipArchiveMode]::Update
$Zip    = New-Object IO.Compression.ZipArchive($stream, $ZipMode)

($zip.Entries | Where-Object { $Filnavn -contains $_.Name }) | ForEach-Object { $_.Delete() }
$zip.Dispose()
$stream.Close()
$stream.Dispose()

zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class