Log4j Scan with Mitigation

<?xml version="1.0" encoding="utf-8"?>
<ScExport xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns="http://www.kaseya.com/vsa/2008/12/Scripting">
  <Procedure name="Log4j Scan with Mitigation" treePres="3" id="1602578046" folderId="343145199419532" treeFullPath="myProcedures - NetworkDepot.Kyle.Test 2021">
    <Body description="Script Name: Log4j Scan with Mitigation&#xA;Script Desc: Uses a modified version of the Datto mitigation script to work with Kaseya. This runs a scan of the home drive on the local machine (using YARA) for potential Log4j. Also sets the mitigation field &quot;LOG4J_FORMAT_MSG_NO_LOOKUPS&quot;. Can report using $Log4j$, $Log4jOOD$. Emails YARA failures and scan detections to Kaseya admin.&#xA;&#xA;Date: 12/14/2021&#xA;Company: Virtual Administrator&#xA;Author: Kyle&#xA;&#xA;(c) Copyright 2021 Network Depot, LLC (Virtual Administrator) ALL RIGHTS RESERVED.   This script is the property of Network Depot, LLC (dba VirtualAdministrator), and use is restricted to active clients.  Do not re-distribute without written authorization.">
      <Statement description="Setup a working folder" name="GetVariable" continueOnFail="false">
        <Parameter xsi:type="EnumParameter" name="VariableType" value="AgentTempDirectory" />
        <Parameter xsi:type="StringParameter" name="SourceContent" value="" />
        <Parameter xsi:type="StringParameter" name="VariableName" value="kworking" />
      </Statement>
      <Statement name="GetVariable" continueOnFail="false">
        <Parameter xsi:type="EnumParameter" name="VariableType" value="ConstantValue" />
        <Parameter xsi:type="StringParameter" name="SourceContent" value="#kworking#\VA_Log4jScan" />
        <Parameter xsi:type="StringParameter" name="VariableName" value="localpath" />
      </Statement>
      <Statement name="GetVariable" continueOnFail="false">
        <Parameter xsi:type="EnumParameter" name="VariableType" value="ConstantValue" />
        <Parameter xsi:type="StringParameter" name="SourceContent" value="#localpath#\Log4jScan" />
        <Parameter xsi:type="StringParameter" name="VariableName" value="log4jpath" />
      </Statement>
      <Statement name="ExecuteShellCommand" continueOnFail="false">
        <Parameter xsi:type="StringParameter" name="Command" value="rmdir #localpath# /s /q" />
        <Parameter xsi:type="EnumParameter" name="ExecuteAccount" value="System" />
        <Parameter xsi:type="BooleanParameter" name="Is64Bit" value="False" />
      </Statement>
      <Statement name="ExecuteShellCommand" continueOnFail="false">
        <Parameter xsi:type="StringParameter" name="Command" value="mkdir #localpath#" />
        <Parameter xsi:type="EnumParameter" name="ExecuteAccount" value="System" />
        <Parameter xsi:type="BooleanParameter" name="Is64Bit" value="False" />
      </Statement>
      <Statement description="Grab the Mitigation and Scan tool" name="GetURL" continueOnFail="false">
        <Parameter xsi:type="StringParameter" name="URL" value="http://files.mymsp.com/downloads/Scripts/Log4jScan.zip" />
        <Parameter xsi:type="StringParameter" name="ResponseFileName" value="#localpath#\Log4jScan.Zip" />
        <Parameter xsi:type="BooleanParameter" name="WaitComplete" value="True" />
      </Statement>
      <Statement name="Unzip file" continueOnFail="false">
        <Parameter xsi:type="StringParameter" name="Parameter1" value="#localpath#\Log4jScan.Zip" />
        <Parameter xsi:type="StringParameter" name="Parameter2" value="#localpath#\Log4jScan" />
        <Parameter xsi:type="StringParameter" name="Parameter3" value="True" />
      </Statement>
      <Statement name="Execute Powershell Command (64-bit, Run As System)" continueOnFail="false">
        <Parameter xsi:type="StringParameter" name="Parameter1" value="#log4jpath#\scanner-8b-mitigate.ps1" />
        <Parameter xsi:type="StringParameter" name="Parameter2" value="-Dir &quot;#log4jpath#&quot;" />
        <Parameter xsi:type="StringParameter" name="Parameter3" value="True" />
      </Statement>
      <Statement name="WriteScriptLogEntry" continueOnFail="false">
        <Parameter xsi:type="StringParameter" name="Comment" value="psresult: #global:psresult#" />
      </Statement>
      <If description="">
        <Condition name="TestFile">
          <Parameter xsi:type="StringParameter" name="Path" value="#log4jpath#\Log4jscan.txt" />
          <Parameter xsi:type="EnumParameter" name="Condition" value="Exists" />
          <Parameter xsi:type="StringParameter" name="Value" value="" />
        </Condition>
        <Then>
          <If description="">
            <Condition name="TestFile">
              <Parameter xsi:type="StringParameter" name="Path" value="#log4jpath#\log4jscanresult.txt" />
              <Parameter xsi:type="EnumParameter" name="Condition" value="Exists" />
              <Parameter xsi:type="StringParameter" name="Value" value="" />
            </Condition>
            <Then>
              <Statement name="GetFile" continueOnFail="false">
                <Parameter xsi:type="StringParameter" name="RemoteFileName" value="#log4jpath#\Log4jscan.txt" />
                <Parameter xsi:type="StringParameter" name="KServerFileName" value="Log4jscanfull.txt" />
                <Parameter xsi:type="EnumParameter" name="Action" value="OverwriteNoAlert" />
              </Statement>
              <Statement name="GetVariable" continueOnFail="false">
                <Parameter xsi:type="EnumParameter" name="VariableType" value="FileContent" />
                <Parameter xsi:type="StringParameter" name="SourceContent" value="#log4jpath#\log4jscanresult.txt" />
                <Parameter xsi:type="StringParameter" name="VariableName" value="scanresult" />
              </Statement>
              <Statement name="GetVariable" continueOnFail="false">
                <Parameter xsi:type="EnumParameter" name="VariableType" value="FileContent" />
                <Parameter xsi:type="StringParameter" name="SourceContent" value="#log4jpath#\Log4jscan.txt" />
                <Parameter xsi:type="StringParameter" name="VariableName" value="fullscanresult" />
              </Statement>
              <If description="check for issues running or possible vulnerability">
                <Condition name="CheckVariable">
                  <Parameter xsi:type="StringParameter" name="VariableName" value="#fullscanresult#" />
                  <Parameter xsi:type="EnumParameter" name="Condition" value="Contains" />
                  <Parameter xsi:type="StringParameter" name="Value" value="YARA was unable to run on this device." />
                </Condition>
                <Then>
                  <Statement name="SendEmail" continueOnFail="false">
                    <Parameter xsi:type="StringParameter" name="To" value="#adminDefaults.adminEmail#" />
                    <Parameter xsi:type="StringParameter" name="Subject" value="Log4j scan failed on #vMachine.machName#" />
                    <Parameter xsi:type="MultiLineStringParameter" name="Body" value="#fullscanresult#" />
                  </Statement>
                  <Statement name="WriteScriptLogEntry" continueOnFail="false">
                    <Parameter xsi:type="StringParameter" name="Comment" value="YARA was unable to run on this device. $Log4j$ $Log4jOOD$" />
                  </Statement>
                </Then>
                <Else>
                  <Statement name="WriteScriptLogEntry" continueOnFail="false">
                    <Parameter xsi:type="StringParameter" name="Comment" value="#scanresult# $Log4j$" />
                  </Statement>
                </Else>
              </If>
              <If description="">
                <Condition name="CheckVariable">
                  <Parameter xsi:type="StringParameter" name="VariableName" value="#scanresult#" />
                  <Parameter xsi:type="EnumParameter" name="Condition" value="Contains" />
                  <Parameter xsi:type="StringParameter" name="Value" value="attack attempts has been found" />
                </Condition>
                <Then>
                  <Statement name="SendEmail" continueOnFail="false">
                    <Parameter xsi:type="StringParameter" name="To" value="#adminDefaults.adminEmail#" />
                    <Parameter xsi:type="StringParameter" name="Subject" value="Log4j possible attack attempt on #vMachine.machName#" />
                    <Parameter xsi:type="MultiLineStringParameter" name="Body" value="#scanresult#" />
                  </Statement>
                  <Statement name="WriteScriptLogEntry" continueOnFail="false">
                    <Parameter xsi:type="StringParameter" name="Comment" value="#scanresult# $Log4jOOD$" />
                  </Statement>
                </Then>
              </If>
            </Then>
          </If>
        </Then>
        <Else>
          <Statement name="WriteScriptLogEntry" continueOnFail="false">
            <Parameter xsi:type="StringParameter" name="Comment" value="Script Error occurred. No output generated. $Log4j$" />
          </Statement>
        </Else>
      </If>
      <Statement name="ExecuteShellCommand" continueOnFail="false">
        <Parameter xsi:type="StringParameter" name="Command" value="rmdir #localpath# /s /q" />
        <Parameter xsi:type="EnumParameter" name="ExecuteAccount" value="System" />
        <Parameter xsi:type="BooleanParameter" name="Is64Bit" value="False" />
      </Statement>
    </Body>
  </Procedure>
</ScExport>
Log4j Scan with Mitigation

How to Download Scripts

Login Here

Search

Get In Touch!

Additional Resources

About Us
